Arch Linux halts package adoptions after infostealer floods the user repository

The Arch Linux project temporarily disabled adoption of packages in its user repository, the AUR, after a wave of malicious takeovers of existing packages. Attackers seized packages through compromised maintainer accounts or by adopting orphaned ones, then shipped a Rust-based infostealer that grabs browser credentials, cryptocurrency wallets, password manager data, cloud and developer secrets, AI service API keys, and SSH keys. It also opens remote command execution over an encrypted Tor channel and spreads to other machines using stolen SSH keys. A researcher tracking the campaign claims more than 200 packages were hit, including some popular ones, though that list is not independently confirmed.

Check

If you use the AUR, review recently installed or updated packages and their maintainers, inspect build files before installing, and rotate SSH keys and secrets if you ran a suspect package.

Affected

Arch Linux users who install from the AUR; a hijacked or adopted package can run a Rust infostealer that harvests developer, cloud, and AI credentials and SSH keys, then self-spreads.

Fix

Read AUR build scripts before installing, prefer well-maintained packages, rotate exposed credentials and SSH keys, watch for outbound Tor connections, and treat orphaned or newly adopted packages with particular caution.