Arch Linux disables AUR package adoption
Date:
Fri, 31 Jul 2026 13:38:04 +0000
Description:
The Arch Linux DevOps team has announced that adoption of orphaned packages
in the Arch User Repository (AUR)
has been disabled due to " the current influx of malicious package
adoptions and follow-up commits made via the AUR ". Michael Taggart
has posted a brief analysis of the malware being added to a long
list of packages in this round of attacks. The payload appears
to be an remote-access trojan (RAT) that takes commands over the
TOR network and attempts to upload a wide range of user data. The project had suspended
new account registration in June. That followed a campaign in which an
attacker or attackers created new accounts to adopt orphaned packages
and push malicious updates to them that would install malware on user
systems. AUR registration was reopened on July13 after the DevOps team added some minor, and apparently
ineffective, restrictions on creating new accounts.
======================================================================
Link to news story:
https://lwn.net/Articles/1086489/
--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet UK HUB @ hub.uk.erb.pw (1337:1/100)