The attackers behind the Atomic Arch supply chain campaign have adapted. After Arch Linux developers purged more than 1,900 compromised packages and declared the community repository clean in mid-June ...

The Arch Linux project has temporarily disabled adoption of Arch User Repository (AUR) packages after a surge in malicious takeovers of existing packages. The decision was announced on the ...

What is the Arch User Repository (AUR)? The Arch User Repository (AUR) is a community-driven repository for Arch Linux users, containing package descriptions known as PKGBUILDs. These PKGBUILDs allow ...

A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru.

Three Arch Linux packages have been pulled from AUR (Arch User Repository) after they were discovered to contain malware. The PDF viewer acroread and two other packages that are yet to be named were ...

Users of the Linux distribution Arch Linux should temporarily refrain from using the Arch User Repositories (AUR). They are once again a gateway for malware. As a temporary immediate measure, the Arch ...

The malware never touched Arch Linux's official repositories. It didn't have to: the attackers simply adopted abandoned packages in the community-run AUR and rewrote their build scripts to plant a ...

Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community ...