01What happened

The story, straight

Arch Linux announced its malware incident affecting the Arch User Repository (AUR) is now under control, with more than 1,500 packages confirmed as compromised. The distribution's maintainers believe the attack vector has been identified and remediated, though the full scope of the breach is still being assessed.

arch linux says the malware situation in the AUR is contained. over 1,500 packages were affected — that's a big number for a repo that runs on trust. maintainers think they've patched the attack vector, but the cleanup is still ongoing.

02Spread timeline

Where it actually started

Jun 13, 2026Origin
Phoronix reports Arch Linux has contained the AUR malware incident affecting 1,500+ packages.phoronix breaks the story: arch linux says the AUR malware incident is contained, 1,500+ packages hit
source
Jun 13, 2026
Story surfaces on Lemmy's technology community, spreading to open-source discussion forums.lemmy picks it up — the linux crowd starts digging into which packages were affected
source

03Source receipts

Every claim, linked

Phoronix
Phoronix report detailing Arch Linux's statement that the AUR malware incident is under control, with 1,500+ affected packages identified
primaryhackernewssignal
Lemmy
Lemmy post in technology@lemmy.world linking to the Phoronix report and driving community discussion
supportinglemmysignal

04What's solid, what isn't

What's solid and what isn't

Confirmed
  • More than 1,500 Arch User Repository packages were affected by the malware incident.
  • Arch Linux maintainers believe the incident is now under control.
Disputed
  • The specific attack vector or vulnerability exploited in the breach.
  • Whether any downstream distros (Manjaro, EndeavourOS) were directly impacted.
  • The full timeline of when the compromise began.
Developing
  • Arch Linux is still assessing the full scope of the breach and remediation details are ongoing.

05Why it matters

The editorial take

The AUR is one of the most trusted community repositories in Linux — it powers the package ecosystem for millions of Arch-based distros including Manjaro and EndeavourOS. A breach of this scale raises serious questions about supply-chain security in community-maintained repositories, a vulnerability that's increasingly targeted across open-source ecosystems.

the AUR is basically the backbone of arch-based distros. 1,500 compromised packages isn't a rounding error — it's a supply-chain attack on one of the most hands-on communities in linux. if you run arch or anything arch-adjacent, check your installed packages.