Arch Linux Suspends AUR Package Adoptions to Block Ongoing Malicious Commit Campaign

Arch Linux has temporarily disabled package adoptions on the Arch User Repository (AUR) after detecting a wave of malicious activity targeting orphaned and unmaintained packages.

The Arch Linux DevOps team confirmed the emergency measure on July 30, 2026, citing an active campaign involving unauthorized package takeovers followed by the injection of harmful commits.

Robin Candau, known in the community as “Antiz,” posted the advisory on behalf of the Arch Linux DevOps team via the official mailing list.

Candau stated that adoption functionality was disabled “due to the current influx of malicious package adoptions and follow-up commits made via the AUR,” while the team investigates and remediates the situation.

Arch Linux Suspends AUR Package

The AUR operates as a community-driven repository where users can submit, maintain, and adopt build scripts (PKGBUILDs) for software not included in Arch’s official repositories. Package adoption allows a user to take ownership of an orphaned package.

This mechanism, while essential to keeping the AUR current, has become an attack vector, as threat actors appear to be systematically adopting abandoned packages and then pushing malicious modifications to the build scripts, potentially compromising any user who installs.

Malicious commits following unauthorized adoptions constitute a known supply chain attack technique in community package repositories. By targeting orphaned packages, attackers exploit reduced scrutiny, as these packages often lack active maintainers to monitor for suspicious changes.

Once adopted, attackers can modify the PKGBUILD file to include malicious code, such as commands that download and execute secondary payloads, exfiltrate credentials, or establish persistence, which then run automatically during the build or installation process via makepkg.

This pattern mirrors past incidents in the open-source ecosystem, including earlier AUR compromises and npm and PyPI supply chain attacks, in which trust in community contribution models was exploited at scale.

In response to the campaign, the Arch Linux team disabled the AUR package adoption feature platform-wide to halt further hostile takeovers.

The team also called on the community to report suspicious adoption events or unreviewed malicious commits and committed to issuing a follow-up statement once the situation is contained.

As of this writing, the team has not disclosed the scope of the affected packages, the number of compromised maintainer accounts, or specific indicators of compromise associated with the malicious commits.

Security-conscious Arch Linux and AUR users should avoid blindly trusting recently adopted or newly modified AUR packages, particularly those with sudden ownership changes.

Manually reviewing PKGBUILD files before building or installing packages is advisable, especially for less common or recently orphaned software.

Users should also monitor official Arch Linux communications for updates on affected packages and remediation guidance, and exercise caution with AUR helpers, favoring tools that surface PKGBUILD diffs for review rather than auto-installing changes.

This incident underscores a growing risk in decentralized package ecosystems: as user-maintained repositories scale, adoption and maintainer transition workflows become attractive targets for supply chain attacks.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.