Back Itnews.Au

Arch Linux halts package adoptions after malware hijacking wave

Itnews.Au • August 2, 2026

Distribution Arch Linux has disabled package adoptions on the Arch User Repository (AUR) after attackers used the feature to push large amounts of malicious code through follow-up commits.

"Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation," Robin Candau, an Arch Linux DevOps team member, said .

Candau asked the community to report suspicious adoption events or unresolved malicious commits and to "stay vigilant".

It is the third AUR security incident since June this year.

A campaign Sonatype researchers dubbed Atomic Arch compromised more than 1500 packages in June, adopting orphaned listings to install a credential-stealing payload via a malicious npm dependency.

After that, a separate wave in mid-June saw more than 70 packages altered to insert Russian-language spam and profanity into users' shell configuration files.

Under Arch's package model, any registered AUR user can adopt a listing once its original maintainer has abandoned it, gaining full commit access to that package's git repository.

Attackers exploited that mechanism, with at least 27 packages being affected, as per a list compiled by AUR contributors.

Each compromised package carried a malicious ELF binary disguised with generic-sounding names such as "linter," "hasher" and "minifier."

Affected listings named in the thread include archutil, boringssl-git and icloudpd, though the list was explicitly framed as a snapshot as of July 30 and may not be final.

The Australian Cyber Security Centre (ACSC) has issued alerts recently on online code repositories being increasingly targeted by supply-chain attackers.

ACSC said the compromise of widely used trusted software packages presents a significant and ongoing risk for organisations.

Arch Linux is a popular, minimalist free and open-source distribution that has formed the basis of others such as game software house Valve's SteamOS

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Arch Linux Freezes AUR Adoption Amid Malware Surge Arch Linux has temporarily disabled package adoption in the Arch User Repository (AUR) following a surge in malicious package takeovers. The decision was announced by contributor Robin Candau on July 30, 2026. Attackers exploited the orphaned package adoption system to push malicious updates, with estimates suggesting over 200 packages may be affected. The latest wave of attacks, which began on July 29, utilizes a two-stage infection method involving a Rust-based infostealer. This malware targets sensitive data, including browser credentials and SSH keys, and can execute commands remotely over Tor. The previous campaign in June had already compromised over 400 packages, distributing a Linux rootkit and info-stealer malware. The Arch Linux team is currently investigating the situation, and no timeline for restoring package adoption has been provided. 6 sources 66

Extracted Entities

Arch Linux halts package adoptions after malware hijacking wave

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)