Man I feel like I dodged a bullet switching to Fedora right before this AUR fuckery started to happen…
Same. I was on Cachy for a few months but recently switched back to Fedora. I’m sleeping very peacefully.
I use malware, btw 😎
Arch should be stopped to be recommended to new users of Linux ASAP
Is anybody really recommending Arch to new users though?
Yeah, there’s a ton of people that recommend Cachy when it is really meant for tinkerers IMHO
friends don’t let friends use the AUR
What’s the alternative?
I only use official and flatpak, I wouldn’t even use flatpak if official had more.
Chaotic aur might be worth looking into if aur is what you want. Everything there is theoretically checked.
all they have to do is to check the damn diff, if that’s not easy for someone then they should stop using a computer altogether. I mean they could just click to random links on the internet right?
Adoptions are a mistake anyways. Remove unmaintained packages and block the name for several months.
Adoption of unmaintained packages to maintain them is not a mistake. The problem is the current implementation, not the idea behind it. It’s like saying the AUR is a mistake, because some people do malicious stuff.
They should find a better solution, like adoption shouldn’t be granted to everyone without question, especially new accounts who didn’t maintain anything before. Mass adoption shouldn’t be granted automatically (limit rate), in example 1 package adoption per day and if someone wants more, admins or moderators need to approve. And updates of newly adopted packages should wait a day.
Also the AUR helpers should do a better job. Always ask if a new adopted package should be updated and give a warning the maintainer changed.
They should find a better solution
Who’s “they”? Because it’s not Arch. Arch doesn’t want to have anything to do with AUR, and neither does any of the Arch-derived distros. They’re all perfectly happy taking advantage of it, of course, but not the responsibility.
Who’s “they”? Because it’s not Arch. Arch doesn’t want to have anything to do with AUR, and neither does any of the Arch-derived distros. They’re all perfectly happy taking advantage of it, of course, but not the responsibility.
Where did you got this nonsense from? What do you mean “they are not Arch”? The AUR is managed and operated by the Archlinux team. As the packages are community-driven content, they cannot guarantee and give support, because it is not their package. But they are still managing and supporting the AUR itself.
- https://archlinux.org/news/active-aur-malicious-packages-incident/ from 2026-06-12 is an official message on the main Archlinux website (there is no new post about the current situation).
- from https://archlinux.org/people/package-maintainers/ : Campbell Jones is an AUR Moderator
- from https://archlinux.org/people/support-staff/ : Andrea Denisse Gómez-Martínez is an AUR Packager, Robin Candau is an AUR Moderator
No way to prevent this, says only repo where this regularly happens





