Back Feeds.4Sysops

Arch Linux freezes AUR package adoptions after malware wave

Feeds.4Sysops •IT News • August 1, 2026

Arch Linux has temporarily frozen package adoptions in the Arch User Repository (AUR) after attackers used maintainer takeovers and orphaned packages to push malicious updates. The campaign reportedly affects dozens of packages and delivers a Linux infostealer with remote access and SSH-worm capabilities. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Arch Linux Freezes AUR Adoption Amid Malware Surge Arch Linux has temporarily disabled package adoption in the Arch User Repository (AUR) following a surge in malicious package takeovers. The decision was announced by contributor Robin Candau on July 30, 2026. Attackers exploited the orphaned package adoption system to push malicious updates, with estimates suggesting over 200 packages may be affected. The latest wave of attacks, which began on July 29, utilizes a two-stage infection method involving a Rust-based infostealer. This malware targets sensitive data, including browser credentials and SSH keys, and can execute commands remotely over Tor. The previous campaign in June had already compromised over 400 packages, distributing a Linux rootkit and info-stealer malware. The Arch Linux team is currently investigating the situation, and no timeline for restoring package adoption has been provided. 6 sources 66

Extracted Entities

Arch Linux freezes AUR package adoptions after malware wave

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (2)

Tools (1)