Arch Linux freezes package adoptions after wave of malware sneaks into user repository

Key points

• Arch Linux disabled package adoption in its Arch User Repository (AUR) in August after a surge in malicious takeovers.
• The campaign began on 29 July 2024 with a booby-trapped package called openconnect-sso.
• Researchers say more than 200 community packages may be affected, including boringssl-git, icloudpd, windscribe-cli-v2-bin and pgadmin4-server.
• The malware is a two-stage Linux infection that steals browser passwords, crypto wallets, SSH keys and API tokens.
• A separate June campaign against AUR pushed a Linux rootkit through more than 400 packages, suggesting the same crew is back.

The Arch Linux project has switched off a core community feature after criminals used it to slip malware onto users' machines.

Arch is a well-liked Linux distribution. Alongside its official software, it runs the Arch User Repository, or AUR: a community-run library where volunteers upload recipes for building extra programs. Anyone can post a package, and anyone can "adopt" one that its original maintainer has abandoned. That adoption process is exactly what the attackers abused.

What did Arch actually turn off?

Arch has temporarily blocked users from adopting AUR packages while it cleans up. Contributor Robin Candau announced the freeze on the project mailing list, citing an "influx of malicious package adoptions and follow-up commits". Uploading brand-new packages is unaffected; taking over an existing one is paused.

Candau asked the community to report suspicious adoptions and recent commits not yet reviewed.

How did the hackers get in?

The attackers took over unloved packages and quietly added malicious code to them. Installing or updating one of those packages ran the code on the victim's machine.

Researchers at the Independent Federated Intelligence Network (IFIN) traced the campaign back to 29 July, starting with a package called openconnect-sso. A Reddit user tracking the incident says it's since spread to more than 200 packages, either by adopting orphaned ones or by breaking into maintainer accounts. Named examples include boringssl-git, icloudpd, windscribe-cli-v2-bin, stirling-pdf-desktop-bin, arduino-language-server-noclang-bin and pgadmin4-server. Those specific compromises haven't been independently confirmed, and no full list has been published yet.

The campaign was first reported by BleepingComputer.

What does the malware do?

It steals almost everything valuable on a developer's machine, then uses that machine to hop to others.

The infection runs in two stages. First comes a loader: it checks whether it's being watched by a debugger, a sandbox or a virtual machine. If the coast looks clear, it installs itself as a background service so it survives reboots, then downloads a Tor client disguised as a normal Linux system process called dbus-daemon and uses the Tor anonymity network to fetch its real payload from a hidden ".onion" address.

The second stage is written in Rust. It hunts for browser-saved passwords, cryptocurrency wallets, password manager vaults, cloud credentials, SSH keys and messaging app tokens. It also gives the attacker a remote shell over Tor, and it can copy itself to other machines using any SSH keys it finds. One infected laptop can quietly log into every server that laptop had access to.

Timeline and known-affected packages

Should ordinary Arch users be worried?

If you personally install packages from the AUR, yes. Treat anything installed or updated since late July as suspect until you've checked it. Users who only pull from Arch's official repositories aren't directly affected.

Anyone who did install from the affected list should assume browser passwords and SSH keys on that machine are exposed. Rotate passwords from a clean device, revoke SSH keys and audit recent logins on cloud accounts. Multi-factor authentication blunts most of the credential theft here, but not SSH key reuse, which is why key rotation matters most.

We first covered AUR-based supply-chain abuse on 12 June 2026; this latest campaign is a harder version of the same attack, scaled up. The AUR has always carried a warning that packages are user-submitted and unreviewed. This is what that warning looks like in practice.