Arch Linux disables AUR package adoption [LWN.net]

The Arch Linux DevOps team has announced that adoption of orphaned packages in the Arch User Repository (AUR) has been disabled due to "the current influx of malicious package adoptions and follow-up commits made via the AUR". Michael Taggart has posted a brief analysis of the malware being added to a long list of packages in this round of attacks. The payload appears to be a remote-access trojan (RAT) that takes commands over the Tor network and attempts to upload a wide range of user data.

The project had suspended new account registration in June. That followed a campaign in which an attacker or attackers created new accounts to adopt orphaned packages and push malicious updates to them that would install malware on user systems. AUR registration was reopened on July 13 after the DevOps team added some minor, and apparently ineffective, restrictions on creating new accounts.

to post comments

Time-based tokens

Posted Jul 31, 2026 14:14 UTC (Fri) by archaic (subscriber, #111970) [Link] (2 responses)

> <..> accounts must verify their email address via a time-limited token which is valid for 24 hours

While no one (or one hundred things) is bulletproof and cat-and-mouse is likely the only long-term solution, having tokens valid for a much more limited time and NOT being valid until some reasonable amount of time has elapsed would be more effective against bots that operate significantly faster than any human can. For example, if you hit that tokenized endpoint X seconds after it was generated, probably not a human. Especially for 2fa. How long does it legitimately take to open your phone and get your key and then type it in and hit send? > 5 seconds presumably. Even if all that is accomplished is bots learning to slow down, I think that could be seen as at least a minor (perhaps merely trivial?) victory.

Defence in Depth

Posted Jul 31, 2026 15:30 UTC (Fri) by davecb (subscriber, #1574) [Link]

No one defence is likely to suffice. The "Orange Book" specified at least a secure login channel, covert-channel blocking, categories (like "my company") and security levels like unclassified, confidential and secret.
The last of those didn't help a lot, but the others made it hard to even get to that point.

So fixing the tokens is a worthwhile part of a comprehensive suite of guards.

Time-based tokens

Posted Aug 2, 2026 2:31 UTC (Sun) by riking (subscriber, #95706) [Link]

Human-driven spam is a real thing that has always happened. You must be prepared to deal with it, too.