Sonatype Finds 1,500 Malicious AUR Packages in 1 Week as Arch Warns Users to Review Scripts
Updated
Updated · ZDNet · Jun 17
Sonatype Finds 1,500 Malicious AUR Packages in 1 Week as Arch Warns Users to Review Scripts
3 articles · Updated · ZDNet · Jun 17
Summary
About 1,500 malicious packages were found in Arch Linux’s user-run AUR over roughly a week, according to Sonatype, marking a second such discovery within days.
AUR’s open upload model appears to be the weak point: anyone can submit package build scripts, while volunteer reviewers may miss obfuscated malware hidden in PKGBUILD or install changes.
Arch’s team urged users to inspect all PKGBUILD and install-script changes during updates and report suspicious commits through the aur-general mailing list.
The report said the payloads and submitters remain unidentified, leaving users with little clarity on potential damage beyond checking installed AUR packages and watching for suspicious outbound traffic.
The episode sharpens long-running concerns over whether AUR’s trust model can scale without stronger package-verification controls, even as Arch itself remains broadly regarded as secure.