1,500 poisoned packages in the Arch User Repository

The Arch Linux security team spent the weekend removing over 1,500 packages from the AUR after discovering malware. That number is wild. This was not a single bad actor slipping one or two packages past review. This was industrial-scale poisoning. The AUR is not an official repository. It is user-submitted build scripts. Anyone can upload. The Arch team does not vet submissions before they go live. The model assumes users read PKGBUILDs before running them. In practice, most of us do not. The malware was basic. Download a payload, execute it. The interesting part is the scale and the fact that it took a weekend to clean up. The team had to manually verify each flagged package, trace dependencies, check for variants. 1,500 is enough that automation alone could not solve it. This is the trade-off with community repositories. The AUR gives you bleeding-edge software and obscure tools that would never make it into official repos. The price is that you are the quality control. You read the PKGBUILD, you verify the checksums, you decide if the maintainer is credible. Most malware in package repos is clumsy. Typosquatting, obvious payloads, dependencies that make no sense. The threat model is not a sophisticated supply chain attack. It is volume. Spray 1,500 variants across the AUR and wait for someone to install one without checking. I have installed AUR packages without reading the build script. I am betting most people have. This incident is a reminder that trusting a package name is not enough. The AUR is powerful because it is open. It is risky for the same reason.

---

Source: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages