Three Times in One Year
The Arch User Repository has now been targeted by supply-chain attackers three times in 2026. The third wave, which began with a malicious commit pushed to openconnect-sso on July 29, prompted Arch Linux to pause all AUR package adoptions on July 30 and freeze all AUR pushes on August 1. It was the same structural vulnerability each time: an attacker adopts an orphaned package through the AUR's standard process, then immediately pushes a malicious PKGBUILD.
The campaign — tracked by researchers as "Atomic Arch" — initially compromised over 400 packages in its first wave (June 2026), later expanding to more than 1,500 affected packages across all three incidents. The malicious PKGBUILDs silently fetched two rogue npm packages — atomic-lockfile and js-digest — during the standard build process, deploying a Rust-based infostealer and, in some cases, an eBPF rootkit targeting developer environments and CI/CD infrastructure.
What Changed on August 11
After eleven days of frozen pushes, Arch Linux restored AUR functionality on August 11 with new structural controls. New users are now subject to a review gate before they can adopt orphaned packages — closing the specific path exploited in all three waves. The team reverted malicious commits, permanently banned the associated accounts, and published a checklist of affected package names so users could audit their systems.
Arch's official repositories — [core], [extra], and [multilib] — remained unaffected throughout all three incidents. The AUR has always operated under a different trust model: packages there are community-maintained, and Arch has long advised users to read PKGBUILDs before building. The attacks exploited the gap between that advice and actual user behavior at scale.
The Harder Question the AUR Now Has to Answer
The review gates are a structural improvement, but they don't resolve the underlying tension in the AUR's design. The repository's strength — that anyone can contribute, and packages can be adopted without friction — is also its weakness. Three attack waves in a single year involving the same adoption vector is a pattern, not an anomaly.
The Arch team has acknowledged they're still working toward a more permanent fix for orphaned package transfers. In the meantime, if you run Arch and install AUR packages, the checklist of affected names is the first place to look. And if you build AUR packages in a CI environment, the window between June and August 2026 warrants a careful review of build logs.
The AUR isn't going away, and neither are the people who want to compromise it. What August 11 bought is time — and, hopefully, the momentum to use it.