Greetings, I’m on the AUR mailing list and there has been huge influx of packages that were maliciously taken over today. Please check the PKGBUILD and be wary especially of new npm depencencies, particularly one named “atomic-lockfile”, but there might be others.

And here I was proud for getting rid of flatpak thought I’d grab what I needed from the AUR. it’s only about 4 applications but still. this is nerve wrecking.

As a reminder, pacman -Qm will give you a list of what you have installed from the AUR. Add a q to supress version numbers.

How is this not the top news article on the main Arch site???

Because it’s not “The Arch Way”. Because it’s always users fault, as were/are DDoS attacks. And yes I know usage of AUR is at users own risk, but Arch’s team has some need for training on publicity. This rant of mine is simply frustration considering their utter lack of communication and victim bl…

It seems Arch security notifications stopped around mid last year. Advisories - Arch Linux The recent vulnerabilities would have been appropriate candidates for entries here. It’s something of a mystery as to why they weren’t mentioned. Perhaps the person/s …

Chaotic AUR affected as well… [image] Chaotic-AUR | Packages | Requests | Recompilation | Reports Feedback Requests Probably don’t update AUR packages for a couple of days! Unl…

They must be completely overwhelmed with all of the attacks; seems like it’s been non-stop for a couple of years now. I wonder if everyone involved with Arch is a true volunteer, because they could really use a paid publicist to handle these types of crises. While I agree that they could use some t…

Are we genuinely nit-picking at this level now, seriously?

[image] UncleSpellbinder: Chaotic AUR affected Thankfully the Chaotic AUR managed to catch them in time, but the warning about other packages from the AUR not in the Chaotic AUR applies: [image] Attack wave on AUR packages Announcements …

[image] Canoe: To be very clear, even reading pkgbuilds will not protect you True, but in these cases the addition of npm is visible and an enormous red flag :red_square:

Malicious AUR packages

General system Newbie

UncleSpellbinder June 12, 2026, 5:19am 31