Open Source · · 2 days

AUR adoption disabled after a second malicious commit wave

A late-July 2026 wave of adopted AUR packages pushed malicious commits that dropped a validator binary into the build path, running with sudo during the build. Arch disabled package adoption on 2026-07-30 and paused all AUR pushes on 2026-08-01.

Part of Atomic Arch turned orphaned AUR packages into infostealers campaign

Six weeks after the Atomic Arch campaign, the Arch User Repository was hit again by the same technique, and this time the project shut the door. On July 30, 2026, Robin Candau, posting as "Antiz" for the Arch Linux DevOps team, told the distribution's mailing list that attackers were adopting neglected packages and quietly injecting malicious code through follow-up commits. Arch disabled AUR package adoption that day. On August 1 it paused AUR pushes entirely while it investigated.

The pattern was a refinement of June's. Rather than adopting a package and immediately rewriting its build script, the operators took ownership and waited, then landed the malicious change in a later commit, where it read as ordinary maintenance rather than the act of a new owner. Researchers corroborated at least 89 package names, catalogued in three batches of 27, 42, and 19, spanning security tooling, desktop utilities, and AI-themed packages. Named examples included openconnect-sso, i915-sriov-dkms, rtk-git, boringssl-git, warp-terminal-git, weather-display, and astro-box.

The openconnect-sso update was the clearest case. It introduced a binary called validator into the package build path, which executed with sudo privileges during the build. That is a step beyond the June waves, which pulled a malicious npm dependency: here the executable went directly into the build process, where AUR helpers already run with elevated privileges as a matter of course. The second stage reused the Tor-backed delivery infrastructure from Atomic Arch, which is what tied the two waves together.

Corgea's assessment was that package adoption itself now belongs in the threat model, and that once malicious content reaches the build path the trusted package name is mostly camouflage. Arch's response conceded the point. Halting adoptions removes the mechanism the attackers were using, and pausing pushes stopped the follow-up commits, but both are blunt instruments against a repository whose model assumes that users read the build scripts they run.

Notes

  • Arch Linux disabled AUR package adoption on 2026-07-30 following the DevOps team announcement by Robin Candau, and paused all AUR pushes on 2026-08-01 while investigating.
  • Reporting corroborated at least 89 package names, community-assembled and still growing. 298 package branches were force-pushed in the window and 290 are confirmed malicious; all 290 trees are held.
  • The one payload, SHA-256 e73a35b3e75e94746428d1a207703d6335933deadee7d1d9c9d0328df7b9df77, was committed under 28 build-tool names such as validator, indexer and compressor. The name is camouflage.
  • Commit messages were camouflage too: upgpkg, updpkgsums, Fix source. Only the PKGBUILD invoking the binary the same commit added separates a poisoned commit from a routine one.

Appendix · Affected releases

openconnect-sso aur
  • The malicious update introduced a validator binary into the build path that ran with sudo privileges during the build.
  • The affected releases were recorded as a wildcard rather than enumerated, so this record asserts no version list.
Additional hijacked AUR packages aur
  • At least 89 package names were corroborated, including i915-sriov-dkms, rtk-git, boringssl-git, warp-terminal-git and astro-box. The affected unit is each package's PKGBUILD, not a versioned artifact.
  • The affected releases were recorded as a wildcard rather than enumerated, so this record asserts no version list.
meshcore-open-git aur
  • The artifact hash identifies the complete malicious AUR snapshot named malicious-aur-80529dcb0d9ee567fbb963cd8b7b33566de3f31c.tar.gz in the static-analysis report. It is an original-archive checksum, not a reconstruction.
  • The recovered 43,640-byte optimizer is exact payload-only evidence. Its measured SHA-256, SHA-1, MD5, size and ELF format all match the independent report, but the complete AUR snapshot bytes remain unavailable.
Payloads and stagesno published version
0.1.0 sha256 f21c979e…9fdc2e3c download unavailable

Indicators

  • commit9d107786fa851c6305dadb3573aab5330a041524
  • commitmeshcore-open-git malicious snapshot 80529dcb0d9ee567fbb963cd8b7b33566de3f31c
  • file_sha256meshcore-open-git optimizer e73a35b3e75e94746428d1a207703d6335933deadee7d1d9c9d0328df7b9df77
  • file_sha256meshcore-open-git PKGBUILD 6126c3e44406592f002ce9465014c2fe869bd8f308e2c86286f6a13042e521e1
  • file_sha256validator (stage 1) 2d25d2ea313767fae5808164224cf6ad610ab09546d1e5a6f033eedbfd98a281
  • file_sha256stage 2 stealer 06c857c8ca798d50c765b4de39e6c4f272ecb57bc8316a8ed4c0fdf02fb59502
  • domainp4ayykxcrxfyzrgfbbkazernntjbz43hgclrheguylzd7kijmtce6zqd.onion
  • filevalidator

References

  1. Arch AUR's August malware wave: openconnect-sso and 89 named packages - Corgeacorgea.com
  2. Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted - Phoronixphoronix.com
  3. Arch Linux Disables AUR Package Takeovers as Attackers Push Malicious Commits - Cyber Security Newscybersecuritynews.com
  4. Arch Linux AUR Malware Halts Adoption and Pushes - Hexnodehexnode.com
  5. New AUR Attack Prompts Adoption Lock - IFINdiscourse.ifin.network
  6. AUR validator malware stage-one analysisgist.github.com
  7. AUR validator malware stage-two analysisgist.github.com
  8. Analysis Report: Malicious meshcore-open-git AUR Packagegist.github.com
  9. Raw Markdown for the meshcore-open-git static-analysis reportgist.githubusercontent.com
  10. AUR malware tracker discussion documenting the two stage-one loader hashesgithub.com

Source record: oss/attacks/arch-aur-august-2026/meta.yaml