Arch Linux has temporarily disabled package adoption functionality on the Arch User Repository (AUR) following a spike in malicious takeovers and follow-up commits targeting orphaned or abandoned packages.
The announcement came from Robin Candau, known in the community as “Antiz,” posting on behalf of the Arch Linux DevOps team via the official mailing list on July 30, 2026.
The AUR allows any registered user to adopt packages that have been orphaned by their original maintainers, a feature designed to keep community-contributed software up to date when maintainers become inactive.
Arch Linux Disables AUR Package
According to the DevOps team, threat actors have been exploiting this mechanism by adopting unmaintained packages and then pushing malicious commits, likely embedding malware, backdoors, or supply-chain payloads into build scripts, known as PKGBUILD files, that unsuspecting users would later compile and install on their systems.
In response, the team disabled the adoption feature entirely while investigating and remediating the incident.
Candau’s message asked the community to report any suspicious adoption events or unaddressed malicious commits, signaling that the cleanup effort remains ongoing and depends heavily on crowdsourced vigilance from users.
The AUR has long operated on a trust-based model, hosting user-submitted build scripts rather than pre-compiled binaries.
This means packages are built locally from instructions that anyone can inspect, but few actually review before installation, making the repository a persistent target for supply-chain attacks.
A single malicious PKGBUILD can execute arbitrary code with elevated privileges during the build or installation process, giving attackers a direct path into a user’s system.
This is not the AUR’s first encounter with malicious packages, as similar incidents have surfaced previously involving typosquatted package names or backdoored scripts slipped into otherwise legitimate-looking submissions.
However, the scale implied by this announcement, significant enough to warrant disabling a core community feature entirely, suggests a more coordinated or automated campaign specifically targeting orphaned packages, which typically receive far less scrutiny than actively maintained ones.
Security-conscious Arch Linux users and AUR maintainers should exercise heightened caution while this situation is being resolved.
It is worth avoiding packages that have recently changed maintainers or show unfamiliar commit activity, and manually reviewing PKGBUILD files before building, particularly for software that has not been updated by its original maintainer in some time.
Relying on AUR helper tools that support diff-viewing before builds can also help catch unexpected script changes early. Staying informed through the Arch Linux mailing list and official channels is equally important, since the DevOps team has promised further updates as the investigation progresses.
Anyone encountering suspicious packages should report them promptly through official Arch Linux channels rather than assuming someone else has already flagged the issue.
The DevOps team has committed to a follow-up update once the situation is under control, though no specific timeline has been given.
Given the AUR’s reliance on community trust and manual review, this incident is likely to reignite discussions about stronger verification mechanisms for package adoption, potentially including mandatory waiting periods, stricter maintainer vetting, or automated detection of anomalous commit patterns.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
 following a spike in malicious takeovers and follow-up commits targeting orphaned or abandoned packages.){kind=link}