> ## Content Index
> Fetch the complete content index at: https://itsfoss.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Arch Linux Pulls the Plug on New AUR Registrations After Malware Flood
- URL: https://itsfoss.com/news/arch-linux-aur-malware-flood/
- Published: 2026-06-16T15:57:05.000Z
- Updated: 2026-06-16T15:57:05.000Z
- Description: More than 1,500 AUR packages got hit, and new waves kept coming.
- Author: Sourav Rudra
- Tags: News

Arch Linux has disabled [new account registrations](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/4JRS73YVTE7JUYHHE3ZDUIHXYHXZ3YQQ/?ref=itsfoss.com) on the Arch User Repository (AUR) as they work to contain a malware campaign that swept through the community package repository last week.

The [AUR](https://itsfoss.com/aur-arch-linux/) is where Arch users look in for software that has not made it into the official repositories yet. It is community-run and unsupported, meaning **packages are user-submitted with no safety guarantee** from the Arch team.

Over 1,500 packages were hit in the first wave alone, and two more waves followed shortly after developers thought they had it cleaned up.

## What happened?

On June 11, Arch developer Jonathan Grotelüschen [opened a dedicated thread](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/?ref=itsfoss.com) on aur-general asking the community to report compromised packages. A formal [news post](https://archlinux.org/news/active-aur-malicious-packages-incident/?ref=itsfoss.com) from Campbell Jones followed the next day, acknowledging "*a high volume of malicious package adoptions and updates*" in the AUR.

Community member a821 traced the initial packages to a malicious npm package called [js-digest](https://socket.dev/npm/package/js-digest?ref=itsfoss.com), which was embedded in post-install scripts. Shortly after, koraynilay [ran a broader search](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/5FDTMKA54RMWNRHJFUAKXEBAFV5WPDUL/?ref=itsfoss.com) against GitHub's AUR mirror using `js-digest` as the marker and found around 850+ packages that were affected, noting the count was already dropping as devs removed them.

By the end of the day, Jonathan [posted](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/FCH7TT6IOVT7D477JKSVJALBKADAARSW/?ref=itsfoss.com) that they had deleted all known malicious commits, linking to [a document](https://md.archlinux.org/s/SxbqukK6IA?ref=itsfoss.com) that listed over 1,500 packages.

That was not the end of it. On June 13, a821 [flagged a new batch](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/NHRO2RT3VRXHQ7O4WQCPTNGNIOQQQAWX/?ref=itsfoss.com) using a different technique. This time, the word "*bun*" was split across string literals as `'b''u''n'` to slip past detection. 

Around 50 packages were caught in this wave, spanning browser packages, a cluster of `nodejs-*` entries, `plasma6-applets-fancytasks`, a NeoVim plugin, and LibreWolf extensions.

A day later, Nicolas Boichat [spotted another batch](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/?ref=itsfoss.com), this one more heavily obfuscated. He caught it using a locally-run Gemma E2B model, with `htbrowser-bin` among the packages he flagged.

## What can you do?

Fast-forward to now, Leonidas Spyropoulos of the Arch Linux team [announced on June 15](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/4JRS73YVTE7JUYHHE3ZDUIHXYHXZ3YQQ/?ref=itsfoss.com) that new AUR account registrations had been disabled as they are busy cleaning up the AUR. 

Another thing to keep in mind is that **the core Arch Linux repositories remain unaffected**, with the malicious commits limited to the AUR.

If you suspect malicious packages might've made it onto your system or you just want to be cautious, then the Arch team suggests reviewing every PKGBUILD and install script change before updating, particularly right now.

And if anything suspicious does show up, they encourage users to flag it via the aur-general mailing list by replying to the [AUR REPORT THREAD](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/?ref=itsfoss.com) (*also linked earlier*).