The Arch Linux User Repository, known as AUR, has suffered a massive attack. More than 400 packages were infected with malware, although the development team is already working on removing the malicious content and blocking the responsible accounts. It is important to clarify that the system's official packages are not compromised. If you use Arch, check your list of AUR packages to avoid security risks.
How to identify and remove compromised packages 🛡️
To check if you have infected software, you can use tools like aurpublish or aurphan to list installed AUR packages. Then, manually review suspicious files in /var/cache/pacman/pkg or use pacman -Qm to get a complete list. If you find anything strange, remove it with pacman -Rns <package>. Don't forget to clean the cache and change passwords if you installed something recently. Prevention is key: avoid packages with few votes or questionable maintenance.
The AUR: where even open source can shut the door on you 😅
The AUR was always that place where users shared their experiments, like a software flea market. Now it turns out some vendors left an extra gift: courtesy malware. The community is already wondering if the next suspicious package will be a desktop theme or a Trojan disguised as a Game Boy emulator. At least, the official developers can sleep soundly: they are not to blame for users getting excited with sudo pacman -Syu.