The Arch Apocalypse of June 2026
Well... maybe it's not quite apocalypse, but it's damned serious. Every user of Arch and Linux distributions based on it (CachyOS, Manjaro, Endeavour, etc) needs to know that a major poisoning of the AUR (Arch User Repository) has taken place. At the time I ran a script yesterday to determine if my system had been infected (it wasn't), 1,617 AUR packages had been identified as "updated" with versions containing credential snatchers. (To people not using Arch, the AUR is roughly analogous to Ubuntu PPAs and Fedora RPM Fusion. It is a location for user-maintained packages that are not part of the official vetted repository. The AUR currently lists more than 114,000 packages. The attacker(s) identified packages that were being used but no longer maintained, exploiting existing AUR policy to request and gain maintainer access. No hacking or policy-breaking was done. *If you have Arch or an Arch-based distro, you use AUR packages (many people don't) and you updated them this week, run this ASAP to see if you've installed one of the affected packages:* Bash: bash <(curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh) Fish: bash <(curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | psub) More info is at this page <https://www.reddit.com/r/cachyos/comments/1u4dm5j/how_to_check_if_your_system_was_compromised_avoid/> , -- Evan Leibovitch, Toronto Canada @evanleibovitch / @el56
Thanks for heads up. I'm clean. On 2026-06-13 11:16, Evan Leibovitch via Talk wrote:
Well... maybe it's not quite apocalypse, but it's damned serious.
Every user of Arch and Linux distributions based on it (CachyOS, Manjaro, Endeavour, etc) needs to know that a major poisoning of the AUR (Arch User Repository) has taken place. At the time I ran a script yesterday to determine if my system had been infected (it wasn't), 1,617 AUR packages had been identified as "updated" with versions containing credential snatchers.
(To people not using Arch, the AUR is roughly analogous to Ubuntu PPAs and Fedora RPM Fusion. It is a location for user-maintained packages that are not part of the official vetted repository. The AUR currently lists more than 114,000 packages.
The attacker(s) identified packages that were being used but no longer maintained, exploiting existing AUR policy to request and gain maintainer access. No hacking or policy-breaking was done.
*If you have Arch or an Arch-based distro, you use AUR packages (many people don't) and you updated them this week, run this ASAP to see if you've installed one of the affected packages:*
Bash: bash <(curl -shttps://cscs.pastes.sh/raw/aurvulntest20260611.sh) Fish: bash <(curl -shttps://cscs.pastes.sh/raw/aurvulntest20260611.sh | psub) More info is at this page <https://www.reddit.com/r/cachyos/comments/1u4dm5j/how_to_check_if_your_system_was_compromised_avoid/>,
-- Evan Leibovitch, Toronto Canada @evanleibovitch / @el56
------------------------------------ Description: GTALUG Talk Unsubscribe viaTalk-unsubscribe@lists.gtalug.org Start a new thread:talk@lists.gtalug.org This message archived athttps://lists.gtalug.org/archives/list/talk@lists.gtalug.org/message/SDFCJ5G...
On Sat, Jun 13, 2026 at 8:18 AM Evan Leibovitch via Talk < talk@lists.gtalug.org> wrote:
Well... maybe it's not quite apocalypse, but it's damned serious.
Every user of Arch and Linux distributions based on it (CachyOS, Manjaro, Endeavour, etc) needs to know that a major poisoning of the AUR (Arch User Repository) has taken place. At the time I ran a script yesterday to determine if my system had been infected (it wasn't), 1,617 AUR packages had been identified as "updated" with versions containing credential snatchers.
(To people not using Arch, the AUR is roughly analogous to Ubuntu PPAs and Fedora RPM Fusion. It is a location for user-maintained packages that are not part of the official vetted repository. The AUR currently lists more than 114,000 packages.
The attacker(s) identified packages that were being used but no longer maintained, exploiting existing AUR policy to request and gain maintainer access. No hacking or policy-breaking was done.
*If you have Arch or an Arch-based distro, you use AUR packages (many people don't) and you updated them this week, run this ASAP to see if you've installed one of the affected packages:*
Bash:
bash <(curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh)
Fish:
bash <(curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | psub)
More info is at this page <https://www.reddit.com/r/cachyos/comments/1u4dm5j/how_to_check_if_your_system_was_compromised_avoid/> ,
The irony of downloading and directly executing an unknown script to detect a security issue :-). Evan, I understand why you did it this way, but I just found it very amusing :-)
-- Evan Leibovitch, Toronto Canada @evanleibovitch / @el56 ------------------------------------ Description: GTALUG Talk Unsubscribe via Talk-unsubscribe@lists.gtalug.org Start a new thread: talk@lists.gtalug.org This message archived at https://lists.gtalug.org/archives/list/talk@lists.gtalug.org/message/SDFCJ5G...
On Sat, Jun 13, 2026 at 12:40 PM Dhaval Giani <dhaval.giani@gmail.com> wrote:
The irony of downloading and directly executing an unknown script to detect a security issue :-). Evan, I understand why you did it this way, but I just found it very amusing :-)
I absolutely get that. That's why I also gave the source location underneath for the skeptical; it shows the contents of the script I pointed to so it wouldn't be unknown or merely a "trust me" thing. (After all, this whole incident has been over an exploitation of trust.) I also wouldn't post anything like that which I hadn't already tried myself. - Evan
participants (3)
-
Dhaval Giani -
Evan Leibovitch -
William Park