Arch Linux freezes package adoptions after wave of malware sneaks into user repository
A stealer that harvests browser logins, crypto wallets and SSH keys has spread through more than 200 community-maintained Arch packages, forcing the project to hit pause.
Key points
- Arch Linux disabled package adoption in its Arch User Repository (AUR) on August after a surge in malicious takeovers.
- The campaign began on 29 July 2024 with a booby-trapped package called openconnect-sso.
- Researchers say more than 200 community packages may be affected, including boringssl-git, icloudpd and pgadmin4-server.
- The malware is a two-stage Linux infection that steals browser passwords, crypto wallets, SSH keys and API tokens.
- A separate June campaign against AUR pushed a Linux rootkit through over 400 packages, suggesting the same crew is back.
The Arch Linux project has switched off a core community feature after criminals used it to slip malware onto users' machines.
Arch is a well-liked Linux operating system. Alongside its official software, it runs the Arch User Repository, or AUR: a community-run library where volunteers upload recipes for building extra programs. Anyone can post a package. Anyone can "adopt" one that its original maintainer has abandoned.
That adoption process is exactly what the attackers abused.
What did Arch actually turn off?
Arch has temporarily blocked users from adopting AUR packages while it cleans up. Contributor Robin Candau announced the freeze on the project mailing list, citing an "influx of malicious package adoptions and follow-up commits". Uploading brand-new packages is not affected, but taking over an existing one is paused.
Candau asked the community to report suspicious adoptions and recent commits that have not yet been reviewed.
How did the hackers get in?
The attackers took over unloved packages and quietly added malicious code to them. When someone installed or updated one of those packages, the code ran on their computer.
Researchers at the Independent Federated Intelligence Network (IFIN) traced the campaign back to 29 July, starting with a package called openconnect-sso. A Reddit user tracking the incident says it has since spread to more than 200 packages, either by adopting orphaned ones or by breaking into maintainer accounts. Named examples include boringssl-git, icloudpd, windscribe-cli-v2-bin, stirling-pdf-desktop-bin, arduino-language-server-noclang-bin and pgadmin4-server. Those specific compromises have not been independently confirmed, and no full list has been published yet.
The campaign was first reported by BleepingComputer.
What does the malware do?
It steals almost everything valuable on a developer's machine, then uses that machine to hop to others.
The infection runs in two stages. The first stage is a loader: it checks whether it is being watched by a debugger, a sandbox, a virtual machine or a build server. If the coast looks clear, it installs itself as a background service so it survives reboots. It then downloads a Tor client, disguised as a normal Linux system process called dbus-daemon, and uses the Tor anonymity network to fetch its real payload from a hidden ".onion" address.
The second stage is written in Rust. It hunts for:
- browser-saved passwords and cryptocurrency wallets
- password manager vaults and cloud provider secrets
- SSH keys and API keys for AI services
- messaging app tokens
It also gives the attacker a remote shell over Tor, and it can copy itself to other machines using any SSH keys it finds. In practice that means one infected laptop can quietly log into every server that laptop had access to.
Timeline and known-affected packages
| Date | Event |
|---|---|
| June 2024 | Earlier AUR campaign pushes rootkit and infostealer through 400+ packages |
| 29 July 2024 | Current campaign begins with openconnect-sso |
| August 2024 | Arch disables AUR package adoption; 200+ packages suspected |
Should ordinary Arch users be worried?
If you personally install packages from the AUR, yes: treat anything installed or updated since late July as suspect until you have checked it. If you only use Arch's official repositories, this incident does not touch you directly.
Anyone who did install from the affected list should assume browser passwords, SSH keys and any wallets on that machine are exposed. Rotate passwords from a clean device, revoke SSH keys, move crypto funds and audit recent logins on cloud accounts. Multi-factor authentication would blunt most of the credential theft here, but not the SSH key reuse, which is why key rotation matters.
The AUR has always come with a warning that packages are user-submitted and unreviewed. This is what that warning looks like in practice.
