Arch Linux AUR Supply Chain Compromise

[Georgi Guninski]

Arch Linux AUR Supply Chain Compromise — A massive supply chain attack
has compromised over 400 packages in the Arch User Repository (AUR),
distributing a Linux rootkit combined with infostealer malware. The
malware targets sensitive credentials, access tokens, and SSH keys
from compromised systems. All organizations and individuals using
Arch-based systems with AUR packages should audit their environments
immediately.

https://threat-modeling.com/arch-linux-aur-supply-chain-compromise-june-2026/