The Arch Linux project has temporarily disabled adoption of packages within the Arch User Repository (AUR) after a surge in malicious takeovers of existing packages. Contributor Robin Candau announced the move on the distribution’s mailing list, describing it as a temporary measure while maintainers respond to the incident.
“Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation,” Candau wrote, adding that a follow-up update would come once the situation is resolved. Users were asked to report suspicious adoption events or commits that have not yet been addressed.
Campaign Details
Researchers at the Independent Federated Intelligence Network (IFIN) traced the campaign’s start to July 29, beginning with the package ‘openconnect-sso.’ IFIN noted strong similarities to a prior AUR campaign from June, which compromised more than 400 packages to distribute a Linux rootkit and infostealer, including reliance on the Tor network for command and control staging.
The new campaign uses a two-stage infection chain. The first stage acts as a loader that checks for debuggers, sandboxes, virtual machines, and CI/CD environments before installing systemd services and cron jobs for persistence. It then downloads a Tor client disguised as “dbus-daemon” to fetch the second-stage payload from a hidden onion service.
The second stage is a Rust-based Linux x86_64 payload combining infostealer, remote access trojan (RAT), and SSH worm capabilities. It targets browser credentials, cryptocurrency wallets, password manager data, cloud and developer secrets, AI service API keys, SSH keys, and messaging platform tokens. It also gives attackers remote command execution over an encrypted Tor channel and can spread laterally by using stolen SSH keys to copy and run itself on other reachable systems.
Scope Still Unconfirmed
A Reddit user tracking the campaign claims it has expanded to more than 200 AUR packages, compromised either through hijacked maintainer accounts or adoption of orphaned packages. Named packages allegedly affected include boringssl-git, icloudpd, windscribe-cli-v2-bin, stirling-pdf-desktop-bin, openconnect-sso, arduino-language-server-noclang-bin, and pgadmin4-server. As of publication, the full list of suspected malicious packages has not been released, and the compromised status of these packages has not been independently verified.
Arch Linux users should audit recently installed or updated AUR packages for unexpected systemd services, cron jobs, or Tor-related binaries disguised as system processes, and rotate SSH keys and stored credentials if compromise is suspected.