1,579 Arch Linux packages trojanized in AUR attack
An automated attack trojanized 1,579 packages in Arch Linux's AUR. Find out if you're affected and how to protect yourself.
English · Original discussion in Spanish · Published
Massive AUR attack: 1,579 packages trojanized in Arch Linux
Opening a terminal and running `pacman -Syu` has become a game of Russian roulette for Arch Linux and derivative users. Someone automated the adoption of orphaned packages in the Arch User Repository (AUR) and seeded them with malicious code. According to initial findings, the infection window was concentrated between June 9 and 12. The provisional count stands at 1,579 compromised packages, and the number could grow.
The attack mechanism is as simple as it is devastating: a bot claimed ownership of orphaned packages (with no maintainer) and uploaded tampered versions. Any installation or update within those dates could have slipped the trojan in without raising suspicion. Among the affected packages are some well-known ones such as `emacs-magit` or the `libretro-*` series, but the list is much longer.
How to tell if you're infected
The community has released a script that scans installed packages against the blacklist. Simply run it in the terminal to get a verdict. Those who updated before June 8 or after the 13th are safe. Everyone else, especially those who installed AUR packages during those days, should assume their system is contaminated. The recommendation is blunt: change all passwords from another device and wipe the disk.
The underlying problem: trust in AUR
The incident reopens the debate over Arch's community repository model. AUR is an extraordinary tool for accessing software not available in the official repos, but its lack of systematic oversight makes it a perfect target for this kind of attack. While some argue that users should review PKGBUILDs before installing, others point out that the automation of the attack makes the threat impossible to detect at a glance.
For now, there is no date for restoring trust. The repository remains operational, but doubt hangs over every orphaned package. The lesson, painful as it is, is clear: in the Arch ecosystem, security is not a product but a constant practice of vigilance.
Opening a terminal and running `pacman -Syu` has become a game of Russian roulette for Arch Linux and derivative users. Someone automated the adoption of orphaned packages in the Arch User Repository (AUR) and seeded them with malicious code. According to initial findings, the infection window was concentrated between June 9 and 12. The provisional count stands at 1,579 compromised packages, and the number could grow.
The attack mechanism is as simple as it is devastating: a bot claimed ownership of orphaned packages (with no maintainer) and uploaded tampered versions. Any installation or update within those dates could have slipped the trojan in without raising suspicion. Among the affected packages are some well-known ones such as `emacs-magit` or the `libretro-*` series, but the list is much longer.
How to tell if you're infected
The community has released a script that scans installed packages against the blacklist. Simply run it in the terminal to get a verdict. Those who updated before June 8 or after the 13th are safe. Everyone else, especially those who installed AUR packages during those days, should assume their system is contaminated. The recommendation is blunt: change all passwords from another device and wipe the disk.
The underlying problem: trust in AUR
The incident reopens the debate over Arch's community repository model. AUR is an extraordinary tool for accessing software not available in the official repos, but its lack of systematic oversight makes it a perfect target for this kind of attack. While some argue that users should review PKGBUILDs before installing, others point out that the automation of the attack makes the threat impossible to detect at a glance.
For now, there is no date for restoring trust. The repository remains operational, but doubt hangs over every orphaned package. The lesson, painful as it is, is clear: in the Arch ecosystem, security is not a product but a constant practice of vigilance.
Also available in: Deutsch
Summary of a discussion on Burbuja.info - Foro de economía, actualidad y política., translated from Spanish and reviewed before publication. Read the full discussion (29 replies).
More summaries
-
Omarchy: the Linux distro promising AI that lasts a month
Omarchy promises minimalism, keyboard over mouse and AI agents, but the community is already warning: it's just this month's Linux distro hype.
-
Fedora 43 works out of the box: the year of desktop Linux
Fedora 43 boots with wifi and touchscreen working right away, but the first bug shows up within 24 hours. The fine print of desktop Linux.
-
Choosing the Best Linux Distro in 2026: Hardware Matters More
From Ubuntu to Nobara: the right Linux distribution depends on your hardware and budget. The landscape has shifted significantly over the past eight years.
-
Cola Cao 1986 vs 2026: less product, more sugar, same real price
Cola Cao 1986 vs 2026: smaller size, sugar up to 70%, and price adjusted for inflation. Is it still the same product? Data analysis.
-
Why artificial tears don't fix screen-related dry eye
86% of dry eye cases involve Meibomian gland dysfunction, which artificial tears cannot fix. Data and remedies explained.
-
Generic Cialis without prescription: only the medical route is guaranteed
Generic cialis costs 17 euros for 4 pills and is not covered by Spain's public health system. Buying without a prescription has a catch. Here are the legal routes and the ones that aren't.