104
Active AUR malicious packages incident
(archlinux.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 12 Jun 2026
104 points (100.0% liked)
Linux
13931 readers
429 users here now
A community for everything relating to the GNU/Linux operating system (except the memes!)
Also, check out:
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 3 years ago
MODERATORS
Also… yeah, this is a rather damning incitement against the AUR system.
It’s always been “install at your own risk,” but it doesn’t feel like the trust model is sustainable anymore.
It's not without good reason that Arch Linux never supported any AUR automation system beyond
makepkg. You are supposed to take a good look at the PKGBUILD before you continue.It's mostly distros that integrated AUR into their package management that are gnashing their teeth now.
That said, the list of affected packages is mind-bogglingly long and I desperately want to know more about this. Can't all be completely separate incidents.