Arch Linux disables AUR package adoption
The Arch Linux DevOps team has announcedthat adoption of orphaned packages in the Arch User Repository (AUR) has been disabled due to "the current influx of malicious package adoptions and follow-up commits made via the AUR". Michael Taggart has posted a brief analysis of the malware being added to a long list of packages in this round of attacks. The payload appears to be an remote-access trojan (RAT) that takes commands over the Tor network and attempts to upload a wide range of user data.
The project had suspended new account registration in June. That followed a campaign in which an attacker or attackers created new accounts to adopt orphaned packages and push malicious updates to them that would install malware on user systems. AUR registration was reopenedon July 13 after the DevOps team added some minor, and apparently ineffective, restrictions on creating new accounts.
---
to post comments
Time-based tokens
Posted Jul 31, 2026 14:14 UTC (Fri) by archaic (subscriber, #111970) \[Link\] (1 responses)
\> <..> accounts must verify their email address via a time-limited token which is valid for 24 hours
While no one (or one hundred things) is bulletproof and cat-and-mouse is likely the only long-term solution, having tokens valid for a much more limited time and NOT being valid until some reasonable amount of time has elapsed would be more effective against bots that operate significantly faster than any human can. For example, if you hit that tokenized endpoint X seconds after it was generated, probably not a human. Especially for 2fa. How long does it legitimately take to open your phone and get your key and then type it in and hit send? > 5 seconds presumably. Even if all that is accomplished is bots learning to slow down, I think that could be seen as at least a minor (perhaps merely trivial?) victory.
Defence in Depth
Posted Jul 31, 2026 15:30 UTC (Fri) by davecb (subscriber, #1574) \[Link\]
No one defence is likely to suffice. The "Orange Book" specified at least a secure login channel, covert-channel blocking, categories (like "my company") and security levels like unclassified, confidential and secret. The last of those didn't help a lot, but the others made it hard to even get to that point.
So fixing the tokens is a worthwhile part of a comprehensive suite of guards.