Arch Linux has switched off one of the Arch User Repository’s basic features, adopting orphaned or abandoned packages, after attackers used it as their latest way into the AUR. Robin Candau, posting on behalf of the Arch Linux DevOps team on July 30, said adoption is disabled “due to the current influx of malicious package adoptions and follow-up commits made via the AUR.”
If you run Arch or an Arch-based distro and pull anything from the AUR, this is the third scare in as many months, and it’s worth pausing before you update or install from there.
What Happened
According to a technical writeup from the Independent Federated Intelligence Network, the current campaign started on July 29 with a package called ‘openconnect-sso,’ and the attack technique closely mirrors the previous campaign, including staging its payloads through the Tor network. The infection runs in two stages: a first-stage loader that checks for debuggers, sandboxes, virtual machines, and CI/CD environments before quietly installing itself via systemd services and cron jobs, then fetches a Tor client disguised as dbus-daemon to pull down the second stage from a hidden .onion server. That second stage is a Rust-based infostealer aimed at browser credentials, cryptocurrency wallets, password manager data, cloud and developer secrets, AI service API keys, SSH keys, and messaging app tokens — and it can also execute remote commands and spread to other machines using stolen SSH keys.
This isn’t a first offense. Arch’s AUR came under a similarly sophisticated malware campaign involving more than 1,500 malicious packages last month, on top of a separate influx of spam and profanities, and June saw a rootkit-and-infostealer campaign hit over 400 packages. Disabling adoptions is a blunt fix, it doesn’t stop malicious uploads or takeovers of accounts that are already compromised, only the specific route of grabbing ownership of an existing package. archlinux
What to do About it
Arch hasn’t set a timeline for restoring adoptions and says it will follow up once it’s able to, in the meantime asking users to report suspicious adoption events or commits. There’s no confirmed list of affected packages yet, so the practical move for AUR users is the usual one, just more urgent: check the PKGBUILD and recent commit history before installing or updating anything from the AUR, especially packages that changed maintainers recently, and hold off adopting orphaned packages yourself until Arch lifts the freeze.
