Article URL: https://lwn.net/Articles/1086489/ Comments URL: https://news.ycombinator.com/item?id=49123208 Points: 5 # Comments: 0

The Arch Linux DevOps team has announced that adoption of orphaned packages in the Arch User Repository (AUR) has been disabled due to "the current influx of malicious package adoptions and follow-up commits made via the AUR". Michael Taggart has posted a brief analysis of the malware being added to a long list of packages in this round of attacks. The payload appears to be an remote-access trojan (RAT) that takes commands over the Tor network and attempts to upload a wide range of user data. The project had suspended new account registration in June. That followed a campaign in which an attacker or attackers created new accounts to adopt orphaned packages and push malicious updates to them that would install malware on user systems. AUR registration was reopened on July 13 after the DevOps team added some minor, and apparently ineffective, restrictions on creating new accounts. Posted Jul 31, 2026 14:14 UTC (Fri) by archaic (subscriber, #111970) [Link] (1 responses) While no one (or one hundred things) is bulletproof and cat-and-mouse is likely the only long-term solution, having tokens valid for a much more limited time and NOT being valid until some reasonable amount of time has elapsed would be more effective against bots that operate significantly faster than any human can. For example, if you hit that tokenized endpoint X seconds after it was generated, probably not a human. Especially for 2fa. How long does it legitimately take to open your phone and get your key and then type it in and hit send? > 5 seconds presumably. Even if all that is accomplished is bots learning to slow down, I think that could be seen as at least a minor (perhaps merely trivial?) victory.