Last month the Arch Linux User Repository "AUR" saw [1]more than 1,500 malicious packages amid [2]a sophisticated malware attack and then also seeing an influx of [3]spam and profanities amid this community/user-maintained repository for the popular Arch Linux distribution. Unfortunately, there is another round of AUR troubles.

The Arch Linux team [4]announced that due to the current influx of malicious package adoptions, they have decided for now to disable package adoptions in AUR while they handle the situation. They encourage users as well to report suspicious adoption events/comments and to stay vigilant.

[5]

There is [6]this mailing list thread outlining AUR malware from yesterday and today. There are dozens of AUR packages this round from i915-sriov-dkms to rtk-git, boringssl-git/hasher, archutil/linter, warp-terminal-git, weather-display, astro-box, and many others.



[1] https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500

[2] https://www.phoronix.com/news/Arch-Linux-AUR-More-Malware

[3] https://www.phoronix.com/news/Arch-Linux-AUR-Russian-Spam

[4] https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/DRDEU3JUSC72CB265XHXPFA3DFSLXPBP/

[5] https://www.phoronix.com/image-viewer.php?id=2026&image=arch_linux_lrg

[6] https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/P4WIRHTFNH2YZWQHGBAKQWX5YOAFIDLY/