New Attack Puts Arch’s AUR Into Lockdown… Again [image] New Attack Puts Arch's AUR Into Lockdown… Again - FOSS Force Arch Linux’s AUR faces a fresh security scare, prompting another round of lockdown measures from the project’s DevOps team. Est. reading time: 3 minutes …

See this: [image] Danger - AUR packages with suspicious binaries Pacman & AUR helpers $ ./archcanary.sh Archcanary v0.1.21 Scanned: 2026-08-01 16:46 Lists loaded package_list.txt infostealer + eBPF rootkit 1936 pkgs CHAOS RAT 7 pkgs Russian Spam …

A thread regarding this already exists. This thread should probably be locked.

[image] milkytwix: And no, the AUR is not “in lockdown”. Adopting packages is disabled. Updating packages was disabled later too.

Had a AUR update within the last 2 hours.

[image] sammiev: Had a AUR update within the last 2 hours. Maintainer can’t update anything in the AUR, users can still download. See: https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/YPJ3FQYJTJXXY3RUXCYLMHUKHLIUNVFF/

This second AUR wave is still unfolding — here’s how you can help For those following the second AUR attack (late July, separate from June’s incident) — the first confirmed package is openconnect-sso, and as of the last update from the people tracking it, new malicious commits were still being foun…

I wonder why someone would attack arch, it’s linux that not many users use. 4-5% of the users on the world are using linux. Why attack such a small group ? The only reason i can think of is because of a failed arch install :joy:

It’s probably a good idea to lock this thread. Or merge it to one of the others. Carrying on a conversation here, especially about Archcanary, is just going to get confusing. There is already an Archcanary thread: [image] Archcanary — a layered security scanner for Ar…

Everything has already been said in this thread. Please check out the relevant ones.

AUR Attacked - again

General system Newbie

milkytwix August 2, 2026, 2:10pm 2

See this:

And no, the AUR is not “in lockdown”. Adopting packages is disabled.