Arch Linux has temporarily disabled package adoption in the Arch User Repository following a surge in malicious takeovers and harmful commits.
Robin Candau, on behalf of the Arch Linux DevOps team, announced the restriction on July 30. Package adoption will remain unavailable while the team handles the situation. No estimate has been given for when the feature will return.
To clarify, in the AUR, packages with maintainers who have stepped down can be marked as orphaned. Another registered user can adopt the package, become its maintainer, and push updated build instructions. While this helps keep abandoned packages alive, it also allows attackers to take control of trusted package names and replace their contents with malicious changes.
Reports on the AUR mailing list on July 30 described orphaned packages being adopted and modified so their source arrays downloaded unfamiliar binary files. The activity affected multiple packages and continued through newly created accounts after earlier ones were banned.
Importantly, Arch Linux has disabled only the adoption mechanism, rather than placing the entire AUR into read-only mode. Existing maintainers can still work on their packages, but users trying to adopt an orphaned package must wait until the restriction is lifted.
The Arch team is asking community members to report suspicious adoption events or commits that have not yet been addressed. Users should also be cautious when installing or updating AUR packages and inspect changes to PKGBUILD, install scripts, source URLs, and any new binary downloads before proceeding.
The latest activity follows a larger AUR security incident disclosed by Arch Linux on June 12. The project reported a high volume of malicious package adoptions and updates and warned that account creation, package submissions, updates, and adoptions could be affected while mitigations were introduced.
Importantly, just to be clear, the incident has nothing to do with Arch Linux’s official repositories. The AUR is a community-operated collection of build scripts rather than an officially supported binary repo by the Arch team, so devs have long advised users to review package contents before building anything obtained from it.
For now, users can continue installing and updating AUR packages. Arch Linux will publish a follow-up announcement once the package adoption feature is restored.
