Arch User Repository

Arch Linux faced two waves of malicious package attacks in the Arch User Repository (AUR) in 2026, affecting more than 1,500 packages in the first wave and dozens more in the second, prompting the dis…

Around 1,500 packages in the Arch User Repository (AUR) were compromised with rootkit-like malware. The attacker exploited a policy that allows takeover of orphaned packages after a two-week waiting p…

A supply chain attack on the Arch Linux User Repository compromised over 1,500 packages, highlighting vulnerabilities in open-source distribution channels. A new open-source tool, repo-slopscore, dete…