Attackers hijacked over 1,500 Arch Linux packages
Attackers compromised the Arch Linux User Repository (AUR), hijacking over 1,500 packages and sneaking in credential-stealing malware as part of a supply chain attack. The malicious code targeted user credentials, GitHub API keys, and environment variables.
Background
- Arch Linux is a lightweight, rolling-release Linux distribution popular among experienced users. Its package manager is called pacman.
- The AUR (Arch User Repository) is a community-driven repository where users can submit and share software packages that aren't in the official Arch repos. It's a key part of the Arch ecosystem but carries less oversight than official channels.
- Packages in the AUR are built from "PKGBUILD" scripts—recipe-like files that tell the system how to download, compile, and install software.
- This incident: attackers compromised several AUR package maintainer accounts and injected malicious code into PKGBUILD files. The malware targeted credentials (like SSH keys and login info). Because Arch users trust AUR packages as part of normal workflow, this is a supply-chain attack—malware introduced at the source of software distribution, not via a separate download.
- Over 1,500 packages were affected before the malicious changes were caught and reverted. It underscores the risk inherent in AUR's trust-based, decentralized model.