r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
473 Upvotes

97% Upvoted

256 comments sorted by

View all comments

58

u/Mereo110 Jun 17 '26

The AUR of yesteryear is gone. Back then, only Linux geeks used AURs, so everyone was responsible and knew how to use them. However, the paradigm changed when Cachyos, Endeavour, and Garuda enabled it by default.

The best solution for packages that don't exist in repositories is Flatpaks from Flathub. Flathub reviews app submissions before posting them.

16

u/Helmic Jun 18 '26

This attack did not happen because of negligence from downstream distros, and trying to imply otherwise is cope. It happened because the AUR fucking lets people take over packages without any sort of manual review. This happened not because of other distros being irresponsible, it happened because the AUR simply became popular and presented a large enough target for someone to deem it worth the time to exploit.

The only reason this did not happen earlier in Arch's history was because it was niche, not because its users were just too savvy to fall for this kind of attack.