The Arch Linux AUR had over 400 packages compromised with malware
https://www.gamingonlinux.com/2026/06/the-arch-linux-aur-had-over-400-packages-compromised-with-malware/Open linkView original on lemmy.zipSyndicated from the fediverse. Read and engage on the original instance.
View original on lemmy.ziphttps://www.gamingonlinux.com/2026/06/the-arch-linux-aur-had-over-400-packages-compromised-with-malware/Open linkView original on lemmy.zip
3 replies
damn, linux heads are real quiet.
This is the fourth? post I've read about it.
The AUR (Arch User Repository) consists of user-submitted content. It's equivalent to installing game.exe from somewebsite.com, so not surprising that it would be used as malware vector.
Some are suggesting Arch is being targeted due to rising popularity of the Arch-based CachyOS.
Have to use paru instead of pacman to grab from aur on cachyos too and it isn't recommended, I think I only ever had blender from there since it worked better with my amd gpu than the official tar, cachyos repo, and the flatpak.