Arch Linux disabled package adoption on the Arch User Repository on July 30 following a third sustained wave of malicious takeovers dubbed "Atomic Arch." The campaign began in late May when attackers started adopting orphaned packages and embedding compiled ELF binaries directly into build scripts, effectively bypassing the npm and JavaScript-based detection methods that caught the earlier waves. Despite Arch developers declaring the repository clean in mid-June after purging more than 1,900 compromised packages, the threat quickly escalated with obfuscated downloaders and static payloads that execute during the makepkg build phase. The ongoing crisis has exposed the fundamental tension between an open, community-maintained repository and supply-chain security, leaving adoption temporarily frozen while the ecosystem develops more robust trust and detection mechanisms.

Arch Linux Disables Package Adoption After Third Wave of AUR Malware Campaign

Three distinct attack vectors in three months, and the fundamental question of how to secure an open-source repository remains unanswered.

Arch Linux disabled package adoption on the Arch User Repository on July 30 after a third sustained wave of malicious takeovers began surfacing. The attack, now tracked under the nickname "Atomic Arch," has compromised well over 1,900 packages across three distinct waves since late May.

The first wave hit around June 9. Attackers adopted orphaned packages and slipped in npm install atomic-lockfile commands or equivalent bun hooks. The injected lifecycle scripts silently pulled down a Rust-based credential stealer informally dubbed "deps," which optionally dropped an eBPF rootkit to hide its kernel traces. By June 12, community trackers and Arch staff confirmed more than 1,900 affected packages. The official repositories stayed untouched.

Arch packager Jonathan Grotelüschen declared the known commits deleted within 48 hours. The repository was supposedly clean. It wasn't. Within hours of the all-clear, a second wave rolled out with heavily obfuscated JavaScript downloaders. Now comes Wave Three, a months-long campaign that flips the detection playbook entirely.

The Embedded Binary Problem

User Saren posted a running list on the aur-general mailing list documenting packages that still harbor these static payloads. The binaries use innocuous names like "linter," "minifier," "parser," and "assembler," then execute during the makepkg build phase. No network calls. No npm cache to scan. Just a stripped binary waiting to run the moment you tell Arch Linux to build it.

Arch developer Nicolas Boichat described the second wave as "a little bit more elaborate," and Wave Three appears to follow that same escalation pattern. The shift from hook-based downloads to embedded compilation artifacts bypasses the exact detection methods that caught the previous two attacks. That means simpler scanning tools and dependency checks just got a lot less useful.

Keep in mind that this isn't a software bug. It's the foundation of how the repository works. Anyone can adopt an abandoned package. PKGBUILDs execute arbitrary code on your machine during install. AUR helpers like yay and paru automate those builds, which means most users never read a line of the script they just handed root access to.

secure-os.org put it plainly. Treating yay -S something like pacman -S something is the mistake. The AUR has been hit before. August 2024 brought DDoS attacks. July 2025 delivered the CHAOS RAT. Both were contained. The June 2026 campaign dwarfs them in scale and persistence.

Why Adoption Is Now Frozen

Robin Candau, on behalf of the Arch Linux DevOps team, announced the adoption suspension on July 30. "Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation," Candau wrote. New account registration also took a temporary hit to slow the takeover pipeline.

The story isn't over. On July 31, user Jared Sutton flagged a newly published brave-origin package that ships a binary called "translator." The legitimate version lives on Brave's official repositories. This one is just there to bait users.

If you've built anything from the AUR recently, run the community malware scanner and audit your PKGBUILD cache. Keep an eye on the aur-general archives for the official recovery timeline. Package adoption isn't coming back until the DevOps team says it is.

Head here to check the latest affected package list.