--- title: Arch Linux disables AUR package adoption | daily.dev description: The Arch Linux DevOps team has disabled adoption of orphaned packages in the Arch User Repository (AUR) following a wave of malicious package adoptions.... canonical: https://daily.dev/posts/arch-linux-disables-aur-package-adoption-babap9alh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Arch Linux disables AUR package adoption | daily.dev og:description: The Arch Linux DevOps team has disabled adoption of orphaned packages in the Arch User Repository (AUR) following a wave of malicious package adoptions.... og:url: https://daily.dev/posts/arch-linux-disables-aur-package-adoption-babap9alh og:image: https://api.daily.dev/og/posts/BABAP9Alh.png og:image:alt: Arch Linux disables AUR package adoption og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Arch Linux disables AUR package adoption **[LWN.net](https://daily.dev/sources/lwn)** · 1 min read · 0 upvotes · 0 comments ## Summary The Arch Linux DevOps team has disabled adoption of orphaned packages in the Arch User Repository (AUR) following a wave of malicious package adoptions. Attackers have been adopting orphaned AUR packages and pushing malicious commits that install a remote-access trojan (RAT) communicating over the TOR network and exfiltrating user data. This follows a similar campaign in June that prompted a temporary suspension of new AUR account registrations. Registration was reopened on July 13 with minor restrictions, but those proved ineffective against the renewed attack. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 94 comments across hackernews (as of 2026-08-03). **TL;DR:** The community is largely critical of the AUR's security model, viewing the attack as inevitable given its honor-system design, though many distinguish the AUR from Arch's official repos and debate whether disabling package adoption is a temporary fix or the beginning of the end for the AUR. **Sentiment:** 15% positive · 45% mixed · 40% skeptical **The case for** - Disabling orphaned-package adoption removes a well-known and fundamental attack vector that was always ripe for abuse. - The AUR's PKGBUILD model is transparent and auditable by design, making it more inspectable than curl-piped shell scripts. - Official Arch repos have diligent maintainers comparable to any other distro; the AUR is a separate, opt-in system. **The pushback** - Disabling adoption without a replacement effectively starts the slow death of the AUR, since orphaned packages can never be rescued. - The AUR's lack of any KYC or meaningful barrier to account creation or package publishing made this attack trivially easy to execute. - Most users treat the AUR as a trusted repo and blindly install without reviewing PKGBUILDs, despite explicit warnings not to. - The Arch team tried minor restrictions (email verification) before taking the obvious step of disabling adoption, suggesting slow security response. - Supply-chain attacks via AUR are growing easier and more attractive as Arch-based distros (SteamOS, CachyOS, EndeavourOS) reach less technical audiences. **By community** - hackernews (mixed): Commenters are split between those who see the AUR's compromise as inevitable and structural, and those who defend it as a misunderstood opt-in system, with broad agreement that disabling adoption is necessary but potentially fatal to the AUR long-term. **Hottest debate:** Whether disabling package adoption is a reasonable emergency stopgap or effectively the beginning of the end for the AUR as a useful community resource. **Open questions** - What long-term replacement for package adoption could allow the AUR to survive without reintroducing the same attack surface? - Should the AUR implement server-side sandboxed builds or automated scanning, and is that even feasible given PKGBUILDs that wrap proprietary blobs? - How should Arch address the gap between the AUR's intended 'review before installing' model and the reality that most users blindly trust it? - Would NixOS or other distros suffer the same fate if they reached Arch's user base? **Highlights** > I think the wrongful notion comes from the fact that the vast majority of Arch users use and speak about AUR as if it were a part of arch proper, only paying lip service to reviewing PKGBUILDS, etc. They wrap the default package manager in one that supports AUR and never touch it directly again. It feels closer to if all of GitHub was available in one click through the Microsoft store or windows update. And unfortunately that’s how arch is mainly marketed by its users. “Arch has the latest everything, if it’s not in the repos it’s on AUR” is one of the standard selling points. Of course that speaks to how people use linux insecurely not how Linux is insecure. > — [davkan on hackernews · 1 comments](https://news.ycombinator.com/item?id=49126826) > I'm sure the team are having a rough time with all this, but I don't understand the path you followed to go from the maintainers have not taken this action until now to "This doesn't speak well to the security headspace of the Arch maintainers". Or what "security headspace" means exactly. Yes, lots of people thought disabling package adoption is/was a good idea. It seems quite likely that the Arch DevOps team also could have come up with that one, and they certainly wouldn't have missed all of the people telling them to do so. It seems to me that disabling package adoption is not a desirable thing to do in general, and can only be used as a stopgap response to an emergency, which seems to be what is happening right now. "just disable adoption" certainly can't be a long-term solution: Without adoption, the AUR will slowly fade away as orphaning a package would be permanent. Maybe the idea is to have some sort of approval process to filter adoption requests? In that case the AUR just dies instantly as that would effectively be another official repo with all of the issues that that would bring. > — [qwery on hackernews](https://news.ycombinator.com/item?id=49126872) > >Disabling AUR package adoptions has been like the #1 thing recommended. Do you have a solution to ever reenabling package adoptions? It's pretty much a must have feature for this to exist long term, at least in the AUR's current state where its a repo your not supposed to auto install from but pretty much all users do. Really disabling adoptions is probably step 1 to just EOLing the whole thing. The AUR by definition isn't to be trusted. That's what the official repos are for, you're supposed to read what the package install scripts are doing. > — [ApolloFortyNine on hackernews · 1 comments](https://news.ycombinator.com/item?id=49127443) > A complication is that AUR doesn't publish packages, it's more like FreeBSD ports in that they are the build scripts for packages and the user builds the package on their local machine. Building an AUR PKGBUILD inherently runs arbitrary code on the user machine, and that code is controlled by the maintainer of the AUR package. So you have to scan an arbitrary bash script and determine if it pulls malware, or build the package server side in a sandbox and scan it (and some AUR scripts wrap proprietary software blobs the user is supposed to provide e.g. MATLAB, which makes those impossible to build server side). It's a very big extra layer that malware deployments can hide in. > — [gh02t on hackernews](https://news.ycombinator.com/item?id=49126493) > The reason is popularity. SteamOS is Arch-based and in the hands of a ton of people who aren't necessarily that technical. CachyOS and EndeavourOS have become very popular with the increasing adoption of desktop Linux. The AUR thus becomes an enticing attack surface. > — [static\_motion on hackernews](https://news.ycombinator.com/item?id=49127795) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49123208) · 39 points · 94 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#open-source](https://daily.dev/tags/open-source), [#linux](https://daily.dev/tags/linux), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/arch-linux-disables-aur-package-adoption-babap9alh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Arch Linux disables AUR package adoption","url":"https://daily.dev/posts/arch-linux-disables-aur-package-adoption-babap9alh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/arch-linux-disables-aur-package-adoption-babap9alh"},"datePublished":"2026-07-31T13:41:38.838Z","dateModified":"2026-08-03T17:44:55.170Z","description":"The Arch Linux DevOps team has disabled adoption of orphaned packages in the Arch User Repository (AUR) following a wave of malicious package adoptions....","image":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","thumbnailUrl":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","isAccessibleForFree":true,"articleSection":"LWN.net","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LWN.net","logo":"https://media.daily.dev/image/upload/s--4jjE7GIK--/f_auto,q_auto/v1774960833/logos/lwn?_a=BAMAMiWQ0","url":"https://daily.dev/sources/lwn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/arch-linux-disables-aur-package-adoption-babap9alh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,open-source,linux,malware","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LWN.net","item":"https://daily.dev/sources/lwn"},{"@type":"ListItem","position":3,"name":"Arch Linux disables AUR package adoption"}]} ```