Arch Linux Locks Down AUR Signups Amid Wave of Malicious Commits
The community-run repository is cleaning up more than 1,500 suspected compromised packages after malicious adoptions and updates, the team said.
- On Monday, the Arch Linux team disabled new account registration within the Arch User Repository to facilitate cleanup following a campaign of malicious package adoptions and updates.
- Attackers seized control of more than 1,500 packages by adopting "orphaned" projects, inheriting the trust built by previous maintainers; security firm Sonatype dubbed the campaign "Atomic Arch."
- Edited scripts pulled in a malicious npm package that harvested browser cookies, session tokens, and credentials for GitHub, Slack, and Discord, then shipped the data over Tor.
- Arch maintainers are currently banning malicious accounts and resetting commits while the team works on cleanup; users are advised to read build scripts before installation.
- With roughly 13,000 orphaned packages remaining in the AUR, the attack surface remains enormous, highlighting structural risks in a community model that previously faced denial-of-service attacks and compromised packages containing a Remote Access Trojan.
11 Articles
11 Articles
Arch Linux AUR hit by malware targeting developer secrets
One of the largest open-source package repositories just spent a weekend cleaning up after a malware campaign that did not break into anything. It did not need to. Attackers seized control of more than 1,500 packages in the Arch User Repository, or AUR, the community-run software collection that sits alongside Arch Linux’s official repositories, and […] This story continues at The Next Web
The Register
IT Security News - cybersecurity, infosecurity newsArch Linux locks down AUR signups amid wave of malicious commits
A wave of malicious commits hit the Arch User Repository (AUR) over the weekend, prompting the team to disable new account registration on Monday morning while it cleans up the mess. The issue was first acknowledged on June 12, with a post stating: "We are currently experiencing a high volume of malicious package adoptions and updates in the Arch User Repository." The team warned that users might have issues opening new accounts, pushing package…
More than 1,900 packages provided by users in the Arch Linux User Repository "AUR" directory of the Linux open source Arch Linux distribution have been infected with malwareArch Linux's AUR is confronted with an incident of malware involving packages provided by users and containing malicious commits that are trying to download npm-based payloads during installation. It is important to note that this incident does not affect the ability of users…
Coverage Details
Bias Distribution
- 50% of the sources lean Left, 50% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
