Arch Paused New AUR Sign-Ups After a Malware Flood. The AUR Worked as Designed.

The Arch User Repository is one of Linux's great conveniences and one of its quietest gambles. It is a community dumping ground of build scripts, fast and vast and not gatekept, which is exactly why it works and exactly why it just got flooded. After a malware wave touched more than 1,500 packages^[1], the project pulled the plug on new account registrations.

The attack was not subtle so much as relentless. On the project's mailing list, maintainers flagged batch after batch of malicious uploads^[2], and as fast as they were cleaned up, fresh waves arrived. Pausing sign-ups was less a fix than a tourniquet, buying time to triage without new throwaway accounts pouring in.

Some of the payloads leaned on the modern supply-chain playbook, reaching for sketchy dependencies^[3] that a casual reader would never notice in a build file. The danger was never one obvious virus. It was a small, deniable hook buried in something that looked routine.

The uncomfortable truth is that none of this is a bug in the AUR. It is the AUR working as designed. 'User repository' has always meant you are trusting strangers, and the convenience was always borrowing against that trust.

The lesson is not to abandon the AUR, which remains one of the best things about running Arch. It is to read the PKGBUILD before you install, and to remember that 'someone uploaded it' was never the same as 'someone vetted it.'