Arch Linux's AUR is under attack as malicious packages begin flooding the repository

Published Jul 31, 2026, 3:42 PM EDT Simon is a Computer Science BSc graduate who has been writing about technology since 2014, and using Windows machines since 3.1. After working for an indie game studio and acting as the family's go-to technician for all computer issues, he found his passion for writing and decided to use his skill set to write about all things tech. Since beginning his writing career, he has written for many different publications such as WorldStart, Listverse, and MakeTechEasier. However, after finding his home at MakeUseOf in February 2019, he would eventually move on to its sister site, XDA, to bring the latest and greatest in Windows, Linux, and DIY electronics. Sign in to your XDA account Summary Arch's AUR saw another wave of malicious packages; adoption is now temporarily disabled during cleanup. Don't blindly install AUR packages; review sources and check the published malware list. If uneasy, skip the AUR; some projects (like KDE Linux) removed it from builds over security concerns. It's a common misconception that Linux is still totally free of malware; in truth, we often see intricate and coordinated attacks on the open-source ecosystem. For instance, Arch Linux's repository, AUR, has seen a wave of new malicious commits enter the system, prompting DevOps maintainers to temporarily disable package adoptions while they clean up the attack. Arch Linux's AUR sees a fresh wave of malicious packages It's the second in under two months As spotted by Phoronix, AUR maintainers have had to hit the brakes on allowing adoption of new packages after they detected a new wave of malware striking the repository. The last time this happened was in mid-June, when 1,500 malicious packages landed on the AUR. Antiz, on behalf of the Arch Linux DevOps team, made a post describing what's going on: "Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation. We will send a follow-up once we're able to. In the meantime, feel free to report suspicious adoption events or commits that haven't been dealt with yet, and stay vigilant!" There's also a non-exhaustive list of malware in the AUR that's been posted, so give them a look and double-check if you've downloaded any of them lately. While these attacks may seem scary, it mostly hammers in the idea that you shouldn't grab software without careful consideration, even if it's hosted on something like the AUR. Take extra care when installing packages and don't just absent-mindedly mash 'Y' in the console to advance the process. If you're still a little nervous about using the AUR, you don't need to use it. After all, KDE Linux recently dropped the AUR from its build pipeline over security and reliability concerns, so moving elsewhere is a valid move.