--- title: AUR hit by second malware wave, GCC bans AI code... description: The Arch User Repository was struck by a second coordinated malware campaign in six weeks, this time infecting 200+ packages with a Tor-routed Rust infostealer... canonical: https://daily.dev/posts/aur-hit-by-second-malware-wave-gcc-bans-ai-code-contributions-smcjxelnz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AUR hit by second malware wave, GCC bans AI code contributions | daily.dev og:description: The Arch User Repository was struck by a second coordinated malware campaign in six weeks, this time infecting 200+ packages with a Tor-routed Rust infostealer... og:url: https://daily.dev/posts/aur-hit-by-second-malware-wave-gcc-bans-ai-code-contributions-smcjxelnz og:image: https://api.daily.dev/og/posts/smcjXelNz.png og:image:alt: AUR hit by second malware wave, GCC bans AI code contributions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AUR hit by second malware wave, GCC bans AI code contributions **[Open Source Digest](https://daily.dev/sources/opensource_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary The Arch User Repository was struck by a second coordinated malware campaign in six weeks, this time infecting 200+ packages with a Tor-routed Rust infostealer that checks for sandboxes before activating. GCC's steering committee officially banned AI-generated code from legally significant contributions, drawing a harder line than Linux or LLVM. A CVSS 8.8 sandbox escape in PipeWire's PulseAudio layer (CVE-2026-5674) lets any Flatpak app with socket access achieve arbitrary code execution with no elevated privileges required. Linux desktop market share crossed 10% in North America according to StatCounter, though the jump from 5.5% to 10.6% in a single month warrants skepticism about methodology. ## Content **TLDR:** The Arch User Repository was struck by a second coordinated malware campaign in six weeks, this time infecting 200+ packages with a Tor-routed Rust infostealer that checks for sandboxes before activating. GCC's steering committee officially banned AI-generated code from legally significant contributions, drawing a harder line than Linux or LLVM. A CVSS 8.8 sandbox escape in PipeWire's PulseAudio layer (CVE-2026-5674) lets any Flatpak app with socket access achieve arbitrary code execution with no elevated privileges required. Linux desktop market share crossed 10% in North America according to StatCounter, though the jump from 5.5% to 10.6% in a single month warrants skepticism about methodology. --- ## AUR malware campaign infects 200+ packages with Tor-routed infostealer Starting July 29 with openconnect-sso, attackers compromised over 200 AUR packages including boringssl-git, pgadmin4-server, and warp-terminal-git. The payload is two-stage: a loader that checks for debuggers, VMs, and sandboxes before doing anything, then a Rust-based infostealer that routes over Tor and goes after browser credentials, SSH keys, crypto wallets, and cloud API keys. It also functions as a RAT and SSH worm for lateral movement. This follows a June campaign that hit 400+ packages. Arch DevOps disabled package adoptions and briefly halted all pushes. KDE Linux had already dropped the AUR from its build pipeline before this second wave — that's looking prescient. If you're running AUR packages, check the published malware list and assume compromise on any named package until verified. [Read more](https://daily.dev/feed-by-ids?id=wRepaLbIn&id=9ddt1h8dc&id=Mb7IXoH4A) ## GCC bans AI-generated code from legally significant contributions The GCC steering committee adopted a policy prohibiting LLM-generated code in contributions of 15 or more lines. Smaller contributions are still allowed if tagged with an 'Assisted-by:' marker, and AI-generated test cases are fully exempt. Using AI for research, bug hunting, or review is also fine — the ban is specifically on including generated output in patches. This puts GCC closer to Codeberg's strict stance than to Linus Torvalds' permissive position on Linux or LLVM's 'human in the loop' approach. A policy review is planned for early 2027. [Read more](https://daily.dev/feed-by-ids?id=WVhpm7HB7&id=VsQFr5IRU&id=h9Jt2Hq9Y&id=63nu7MI9E&id=zHkqeJONP) ## CVE-2026-5674: PipeWire sandbox escape lets Flatpak apps execute arbitrary code Three chained flaws in PipeWire's PulseAudio compatibility layer add up to a CVSS 8.8 sandbox escape: the authentication cookie is read but never verified, module loading is enabled by default for 'authenticated' clients, and module-ladspa-sink calls dlopen() on arbitrary paths without validation. A Flatpak app with only --socket=pulseaudio permission can write a malicious shared library to /tmp, send a junk cookie, load the module, and achieve code execution as the logged-in user — no race conditions or elevated privileges needed. Confirmed on Fedora, Ubuntu 24.04, and Debian 13. The fix restricts dlopen() to allowlisted LADSPA plugin directories. Red Hat shipped RHSA-2026:47083 on July 28. Patch PipeWire now and audit Flatpak apps requesting --socket=pulseaudio with filesystem access. [Read more](https://daily.dev/feed-by-ids?id=i32PfSskc&id=X9e0VSJK1) ## Linux desktop market share hits 10% in North America, with caveats StatCounter data for July 2026 shows Linux reaching 10.65% of desktop usage in North America, up from 5.52% in June. The jump is real but the interpretation needs care — a reduction in an 'Unknown' category likely contributed to the spike, and these figures measure web traffic share, not installed base. Cloudflare Radar independently shows a strong Linux desktop presence. Contributing factors include improved hardware compatibility, Valve's Proton and Steam Deck, Windows 10 end-of-life pressure, and broader developer adoption. The 10% figure is a milestone worth noting, not a claim that one in ten North American desktops literally runs Linux. [Read more](https://daily.dev/feed-by-ids?id=XSvptNVXv&id=dUA2Cp2pN) --- ## Also notable - **KDE Plasma 6.8 multi-GPU performance: 40 to 120 FPS with DMA-BUF v6:** Developer Xaver Hugl implemented DMA-BUF v6 support in KWin and reworked multi-GPU buffer copies, enabling direct scan-out and eliminating unnecessary copies — real-world results show 40 to 120 FPS in general eGPU testing and 27 to 50 FPS in Cyberpunk 2077. [Read more](https://daily.dev/posts/IM85oHA5x) - **NetBSD 11.0 ships with RISC-V support and three known security issues:** NetBSD 11.0 adds 64-bit RISC-V support targeting VisionFive 2 and STAR64 boards, but ships with three disclosed vulnerabilities — an hdaudio ioctl privilege check flaw, a remotely triggerable null pointer dereference in ipfilter, and a use-after-free in pf fragment reassembly — none enabled by default; fixes and an 11.1 release are expected within two months. [Read more](https://daily.dev/posts/tygy313RP) - **Dasharo v0.9: first open-source firmware for AMD Ryzen AM5 desktop platform:** 3mdeb released Dasharo v0.9 targeting the MSI PRO B850-P WIFI, built on AMD's openSIL and Coreboot, supporting Zen 4 Phoenix processors, UEFI Secure Boot, Ubuntu 26.04 LTS, and Windows 11 25H2 — the first open-source firmware for a modern consumer AMD AM5 motherboard. [Read more](https://daily.dev/posts/YoWsD35sb) - **Arch Linux disables AUR orphaned-package adoption after attackers inject Tor-based RAT:** Following the malware campaign, Arch Linux disabled new AUR package adoptions entirely; the attack vector was grabbing unmaintained orphaned packages and pushing malicious commits, a structural weakness the AUR's low-barrier model cannot easily close. [Read more](https://daily.dev/feed-by-ids?id=Mb7IXoH4A&id=9ddt1h8dc) - **EU Digital Markets Act forces Google to open DSP wake word detection to third parties by Android 18:** The European Commission ruled that Alphabet must open 11 Android features to third-party developers on equal terms, including always-on DSP-based wake word detection currently restricted to Gemini — required in Android 18 by August 2027, with concurrent multi-assistant support following in Android 19. [Read more](https://daily.dev/posts/CuH4d5IEE) ## Similar posts on daily.dev - [Arch Linux AUR Hit By Another Wave Of Now More Sophisticated Malware Attack](https://daily.dev/posts/arch-linux-aur-hit-by-another-wave-of-now-more-sophisticated-malware-attack-cuifsfguq) · Phoronix · 1 upvotes · 0 comments - [Arch Linux AUR hit by malware targeting developer secrets](https://daily.dev/posts/arch-linux-aur-hit-by-malware-targeting-developer-secrets-sj2f1gofq) · The Next Web · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/aur-hit-by-second-malware-wave-gcc-bans-ai-code-contributions-smcjxelnz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/aur-hit-by-second-malware-wave-gcc-bans-ai-code-contributions-smcjxelnz","headline":"AUR hit by second malware wave, GCC bans AI code contributions","text":"The Arch User Repository was struck by a second coordinated malware campaign in six weeks, this time infecting 200+ packages with a Tor-routed Rust infostealer that checks for sandboxes before activating. GCC's steering committee officially banned AI-generated code from legally significant contributions, drawing a harder line than Linux or LLVM. A CVSS 8.8 sandbox escape in PipeWire's PulseAudio layer (CVE-2026-5674) lets any Flatpak app with socket access achieve arbitrary code execution with no elevated privileges required. Linux desktop market share crossed 10% in North America according to StatCounter, though the jump from 5.5% to 10.6% in a single month warrants skepticism about methodology.","url":"https://daily.dev/posts/aur-hit-by-second-malware-wave-gcc-bans-ai-code-contributions-smcjxelnz","datePublished":"2026-08-03T04:19:26.576Z","dateModified":"2026-08-03T04:19:46.674Z","author":{"@type":"Organization","name":"Open Source Digest","logo":"https://media.daily.dev/image/upload/s--9lMKiPTq--/f_auto,q_auto/v1773839407/logos/opensource_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/opensource_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/opensource_digest","name":"Open Source Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Open Source Digest","item":"https://daily.dev/sources/opensource_digest"},{"@type":"ListItem","position":3,"name":"AUR hit by second malware wave, GCC bans AI code contributions"}]} ```