# Malicious package activity detected in Arch User Repository

> **Key takeaway:** Arch Linux is responding to a high volume of malicious package adoptions and updates within the AUR.

**Published:** 2026-06-12T18:41:28+00:00 
**Source:** Arch Linux Official News 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/active-aur-malicious-packages-incident.html 

## Summary
Arch Linux has reported a significant incident involving malicious updates and package adoptions in the Arch User Repository (AUR). The development team is working to identify malicious commits and prevent further unauthorized pushes. During this period, users may encounter restrictions on creating new accounts, pushing updates, or adopting/creating packages.

## Security incident details
- High volume of **malicious package adoptions** and updates.
- Potential disruptions to **AUR account creation**, **package updates**, and **package adoption/creation** workflows.
- Users are advised to manually inspect all **PKGBUILD** and **install script** changes before updating.

## Why it matters
The incident highlights the inherent security risks of community-driven repositories like the AUR, where users must verify build scripts.