Arch Linux disables AUR signups after 1,500+ packages laced with malicious npm deps

The Arch User Repository had a bad weekend. According to The Register and LWN, what started on June 12 as roughly 400 suspect packages climbed past 1,500 by the time the dust settled, and on the morning of June 15 the Arch team disabled new account registration while they cleaned up.

The mechanism is some that we’ve been seeing around a lot lately: supply chain. Compromised PKGBUILDs were rigged to pull in hostile JavaScript dependencies — LWN describes it as a malicious npm package that exfiltrates data. A more sophisticated second wave landed June 14. Collateral damage included legitimate users who couldn’t open accounts, push updates, or adopt packages while signups were frozen.

This issue only affected the AUR (Arch User Repository) — the community-run, build-it-yourself, “you are the QA” repository — not Arch’s core. The official distribution is unaffected. The AUR holds just over 107,000 packages, with 5,586 updated and 273 added in the past seven days, so there’s plenty of surface for someone to slip a poisoned PKGBUILD into an orphaned package nobody’s watching.

The reminder, as ever: makepkg runs arbitrary code, and an AUR helper that auto-builds without you reading the PKGBUILD is a loaded gun. Read the build files. Be suspicious of packages that suddenly pull npm/pip/curl from nowhere. You miss it and your next build might be a troublesome one.

If you installed or updated anything from the AUR over June 12–15, go re-read those PKGBUILDs.

Sources

• The Register — Arch Linux locks down AUR signups amid wave of malicious commits
• LWN — Hundreds of AUR packages compromised