Arch Linux locks down AUR signups amid wave of malicious commits

posted by Rianne Schestowitz on Jun 15, 2026,
updated Jun 19, 2026

Quoting: Arch Linux locks down AUR signups amid wave of malicious commits —

The core Arch distribution itself is unaffected. The AUR is a community-run package repo – if something isn't in the official repo, it's probably here, assuming nobody's poisoned it. The AUR is user-submitted and unsupported, so users are expected to inspect package build files themselves before installation. The malicious packages attempted to pull in hostile JavaScript dependencies, including npm packages identified in the campaign.

Arch Linux is a fast, lightweight Linux distribution. It isn't for beginners – users need to pick their own display manager and desktop environment as well as their own applications. However, this makes it highly customizable.

The project's website says: "Currently we have official packages optimized for the x86-64 architecture. We complement our official package sets with a community-operated package repository that grows in size and quality each and every day." Unless, of course, miscreants go wild with malicious commits, and the team has to wade in to deal with the problem.

Read On!

It's FOSS:

• Arch Linux Pulls the Plug on New AUR Registrations After Malware Flood

  Arch Linux has disabled new account registrations on the Arch User Repository (AUR) as they work to contain a malware campaign that swept through the community package repository last week.

  The AUR is where Arch users look in for software that has not made it into the official repositories yet. It is community-run and unsupported, meaning packages are user-submitted with no safety guarantee from the Arch team.

  Over 1,500 packages were hit in the first wave alone, and two more waves followed shortly after developers thought they had it cleaned up.

More here:

• Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages

  Arch GNU/Linux suspended account registrations in response to the wave of malicious packages being uploaded to AUR.

FOSS Force:

• AUR Registrations Blocked Amid Ongoing Malware Mess

  Arch has evidently stopped new AUR registrations for the time being while maintainers scrub malware and users debate how to harden the popular community repository.

2 more:

• Arch Linux's largest software repo is blocking sign-ups due to a malware crisis

  You won't see new developers sharing their apps with Arch Linux users in the near future. AUR (Arch User Repository), the Linux distribution's largest repo for community software, is blocking new registrations while maintainers deal with a malware crisis.

• After the AUR Malware Flood, Yay v13 Lets You Script Your Own Safety Net

  The release adds Lua-based hooks alongside a simpler way to see how recently a PKGBUILD was last touched.