news
Here's How I Avoid AUR Malware on Arch Linux
Quoting: How to Avoid AUR Malware on Arch Linux —
July 2025 was not a great month for Arch Linux—the distribution faced two notable malware incidents, both delivered through compromised packages in the Arch User Repository (AUR). On July 16, 2025, three AUR packages—librewolf-fix-bin, firefox-patch-bin, and zen-browser-patched-bin—were found to contain the CHAOS RAT (Remote Access Trojan), as reported by Linux Security. A second incident, reported by Linuxiac, occurred on July 31, 2025, when a re-uploaded google-chrome-stable package appeared in the AUR. This package’s build script included a Python one-liner that fetched and executed a remote script from an untrusted server.
Thankfully, AUR users quickly noticed something was wrong, and the malicious packages were removed from the AUR within 48 hours in both instances. That said, these are not isolated events. In the past, there have been multiple such incidents where bad actors tried to use the AUR to spread malware across various systems.
So does this make the AUR, and in turn Arch Linux, unsafe and risky? Well, the answer is more complicated than a simple yes or no!