Arch's malware wave hit 1,500 AUR packages by climbing through orphans anyone can adopt (phoronix.com)
The official repos were never touched; this lived entirely in the AUR, Arch's explicitly unvetted, build-it-yourself user repository. An infosec consultant posted the exact pacman incantation to find foreign packages on your own box.
The fastest containment wasn't a patch. It was volunteers racing to adopt rarely-updated orphan packages so attackers couldn't, while others argued the AUR needs minimum package ages and adoption limits, like npm.
Sign in to save