--- title: Arch’s AUR Malware Gets Worse with Russian Spam Attacks description: The Arch User Repository (AUR) supply chain attack has escalated, with over 1,500 packages compromised. Attackers hijacked orphaned AUR packages, pushed... canonical: https://daily.dev/posts/arch-s-aur-malware-gets-worse-with-russian-spam-attacks-e2a7zfko1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Arch’s AUR Malware Gets Worse with Russian Spam Attacks | daily.dev og:description: The Arch User Repository (AUR) supply chain attack has escalated, with over 1,500 packages compromised. Attackers hijacked orphaned AUR packages, pushed... og:url: https://daily.dev/posts/arch-s-aur-malware-gets-worse-with-russian-spam-attacks-e2a7zfko1 og:image: https://api.daily.dev/og/posts/e2a7ZfKo1.png og:image:alt: Arch’s AUR Malware Gets Worse with Russian Spam Attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Arch’s AUR Malware Gets Worse with Russian Spam Attacks **[SavvyNik](https://daily.dev/sources/savvynik)** · 9 min read · 0 upvotes · 0 comments ## Summary The Arch User Repository (AUR) supply chain attack has escalated, with over 1,500 packages compromised. Attackers hijacked orphaned AUR packages, pushed malicious PKGBUILDs that stole SSH keys, API tokens, cloud credentials, and other sensitive data. A second wave introduced obfuscated code using hex encoding to drop malicious npm/bun packages. The latest development involves Russian-language spam being injected into shell startup files (bashrc, zshrc, fish config) via post-install scripts — seemingly trolling affected users. Arch-based Linux users are advised to check the official compromised package list, run the provided scanning tool, and rotate all credentials including passwords, SSH keys, and API tokens. Proposed mitigations include stricter orphan package adoption rules, stronger maintainer identity verification, and automated scanning for dangerous patterns like wget, curl, or unexpected package manager calls in PKGBUILDs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Arch Linux AUR hit by malware targeting developer secrets](https://daily.dev/posts/arch-linux-aur-hit-by-malware-targeting-developer-secrets-sj2f1gofq) · The Next Web · 3 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#open-source](https://daily.dev/tags/open-source), [#linux](https://daily.dev/tags/linux), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/arch-s-aur-malware-gets-worse-with-russian-spam-attacks-e2a7zfko1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Arch’s AUR Malware Gets Worse with Russian Spam Attacks","url":"https://daily.dev/posts/arch-s-aur-malware-gets-worse-with-russian-spam-attacks-e2a7zfko1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/arch-s-aur-malware-gets-worse-with-russian-spam-attacks-e2a7zfko1"},"datePublished":"2026-06-17T02:50:41.586Z","dateModified":"2026-06-17T02:51:02.891Z","description":"The Arch User Repository (AUR) supply chain attack has escalated, with over 1,500 packages compromised. Attackers hijacked orphaned AUR packages, pushed...","image":"https://i.ytimg.com/vi/TJT6ybXBVmU/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/TJT6ybXBVmU/sddefault.jpg","isAccessibleForFree":true,"articleSection":"SavvyNik","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SavvyNik","logo":"https://media.daily.dev/image/upload/s--WqWN5vuC--/f_auto/v1743923591/logos/savvynik","url":"https://daily.dev/sources/savvynik"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/arch-s-aur-malware-gets-worse-with-russian-spam-attacks-e2a7zfko1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,open-source,linux,malware","timeRequired":"PT9M","video":{"@type":"VideoObject","name":"Arch’s AUR Malware Gets Worse with Russian Spam Attacks","description":"The Arch User Repository (AUR) supply chain attack has escalated, with over 1,500 packages compromised. Attackers hijacked orphaned AUR packages, pushed...","thumbnailUrl":"https://i.ytimg.com/vi/TJT6ybXBVmU/sddefault.jpg","uploadDate":"2026-06-17T02:50:41.586Z","duration":"PT9M","url":"https://api.daily.dev/r/e2a7ZfKo1","embedUrl":"https://www.youtube.com/embed/TJT6ybXBVmU"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SavvyNik","item":"https://daily.dev/sources/savvynik"},{"@type":"ListItem","position":3,"name":"Arch’s AUR Malware Gets Worse with Russian Spam Attacks"}]} ```