A massive cyberattack has rocked the Arch User Repository (AUR), with attackers ultimately compromising more than 1,900 packages with malware. The malicious code was injected through fake npm dependencies and harmful scripts embedded within installation files. These attacks specifically targeted sensitive data, including browser profiles, saved passwords, and credentials for services such as GitHub, npm, and ChatGPT. Particularly insidious was the integration of an eBPF rootkit, which concealed the malicious code from the system, allowing it to persist undetected on infected machines. The incident primarily affected abandoned packages whose original maintainers were no longer active, making it easier for attackers to seize control of these repositories.

The impact of the attack was particularly significant for users of AUR helper tools like 'yay' or 'paru', as well as for distributions that simplify access to the AUR, including CachyOS and Manjaro. While Arch Linux's official package sources remained completely secure and official users were unaffected, the community faced a substantial security vulnerability. Arch Linux developers responded swiftly and decisively: they actively removed malicious code from all known affected commits and suspended accounts associated with the attack. Throughout the day, the scope of the incident expanded, with initial reports citing over 400 compromised packages before the number rose to nearly 2,000.

After purging all identified malware commits, Arch Linux developers declared the incident under control. They strongly advised affected users to change their passwords and carefully verify scripts before future installations. This incident highlights the inherent risks of community-driven repositories like the AUR, where packages do not undergo the same rigorous review processes as official software sources. It serves as a crucial warning for Linux users, especially those relying on convenience tools that bypass manual checks of package contents.