Arch Linux disables AUR package adoption

The Arch Linux DevOps team has announcedthat adoption of orphaned packages in the Arch User Repository (AUR)has been disabled due to "the current influx of malicious packageadoptions and follow-up commits made via the AUR". Michael Taggarthas posted a brief analysis of the malware being added to a longlist of packages in this round of attacks. The payload appearsto be an remote-access trojan (RAT) that takes commands over theTor network and attempts to upload a wide range of user data.

The project had suspendednew account registration in June. That followed a campaign in which anattacker or attackers created new accounts to adopt orphaned packagesand push malicious updates to them that would install malware on usersystems. AUR registration was reopenedon July13 after the DevOps team added some minor, and apparentlyineffective, restrictions on creating new accounts.