Arch Linux disables AUR package adoption

The Arch Linux DevOps team has made a decision to stop accepting orphaned packages from the Arch User Repository (AUR) due to a surge in malicious package adoptions and follow-up commits made through the AUR. Michael Taggart, a team member, has provided a brief analysis of the malware being distributed in this round of attacks. The malicious payload seems to be a remote-access trojan (RAT) that receives commands via the Tor network and attempts to upload various user data.

The project had previously suspended new account registrations in June. This followed a campaign where an attacker or attackers created new accounts to adopt orphaned packages and upload malicious updates, causing malware to be installed on user systems. AUR account registration was reopened on July 13 after the DevOps team added some minor, seemingly ineffective, restrictions on creating new accounts.