Arch User Repository (AUR)

Reported Context (6)

A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. Trojanized Arch AUR Packages Ran Malware with Root Privileges
campaigns during the same time period, across npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR. Several of those ecosystems hadn't been targeted this way before. Wiz Reports Surge in Cloud Supply-Chain Attacks and Threats to AI Infrastructure in H1 2026
Between 9 and 17 June 2026, someone adopted more than 1,900 orphaned packages in the Arch User Repository and wired them to pull a credential-stealing zombie payload. Atomic Arch Campaign Used Compromised AUR Packages to Deliver an Infostealer
Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. Atomic Arch Campaign Hijacks 400+ AUR Packages to Deliver Rust Stealer and Optional eBPF Rootkit
More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens. Reports Link More Than 400 AUR Packages to Linux Rootkit and Infostealer

Malware (6)

People (10)

Threat Actors (7)

MITRE ATT&CK (15)

Vendors (2)

Products (40)

Tools (4)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.