Onslaught of malware hits Arch Linux's major AUR repository, all uploads suspended

Arch, a major Linux distribution valued for giving users complete control and access to bleeding-edge software, has been forced to shut down all uploads to its AUR repository – the main way users install third-party software. Dozens of malicious packages have been flagged.

At least 120 malicious AUR packages, including some popular tools, have been identified on the Arch mailing list and reverted over the past few days.

“Be 100% careful when trying to update AUR packages now,” one user on Reddit posted, and reports even more, over 200, compromised AUR packages.

The Arch team has been overwhelmed by a flood of malware and has suspended all AUR uploads while the maintainers handle the situation.

“No ETA to share for now, unfortunately. Sorry for the inconvenience,” Arch developer Robin Candau posted on Sunday.

Previously, on July 30th, Arch stopped all package adoptions after identifying an “influx of malicious package adoptions,” Candau announced on the mailing list.

Arch is one of the top operating systems for hardcore Linux enthusiasts who want granular control over which software to run on their systems.

Its official repositories contain vetted essential software accessible via its package manager, pacman. AUR is a go-to source for the extra packages, but this repository is maintained by the community.

Attackers exploited a structural platform’s weakness – packages with no maintainers, which are known as “orphaned.” These abandoned packages can be adopted by any other account on AUR, which then becomes a new maintainer.

Hackers simply claim abandoned packages and push malicious updates, infecting anyone who installs or updates them with infostealing malware.

Disabling all package adoptions wasn’t enough to stop the attacks, and dozens of newly infected packages have been identified since. The attackers likely leveraged stolen credentials to compromise legitimate packages.

The list of compromised packages includes various unofficial builds of llama.cpp AI tools, Google’s BoringSSL, iCloud photo download tool iCloudPD, command-line client for Windscribe VPN service windscribe-cli-v2-bin, and many others.

Attackers also seem to publish entirely new packages that impersonate popular brands, such as Brave.

And the triage appears to be mostly manual. The maintainers have been banning the accounts and reverting the malicious commits reported by other community members.

AUR doesn’t host any source code, it only builds scripts that define installation instructions – where to fetch the code from, and how to build the package. This leaves attackers with many options – they can covertly swap in a malicious download source without changing the original package at all.

This is the third massive supply chain attack affecting AUR this year. Just in June, hundreds of packages were compromised.

The whole community-based model of AUR and open source software in general is now being questioned. Software maintainer identities can’t be easily verified, even legitimate accounts can be compromised, and the supply chains are highly automated.

“Practically, is there a better alternative to Arch/AUR? I've used it for years because of the bleeding-edge packages and stability (for me), but with the increased security incidents, I don't feel safe. I don't have the time/desire to read the build files of every package I install,” one of the most upvoted reactions on Hacker News reads.

“Unfortunately, it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over. LLMs make large-scale and long-term attacks easy and cheap,” another comment reads.

Anyone who suspects having installed a malicious package should assume full compromise. Security researchers who analyzed the payload warn that it plants a backdoor and routes traffic through the Tor anonymity network, disguised as an unrelated process.

It ultimately installs a Rust infostealer collecting crypto wallets, passwords, credentials, SSH keys, browser cookies, and other sensitive data.