You're browsing RuntimeWire with JavaScript disabled. Articles and navigation work fully. Interactive features — search, comments, and newsletter signup — require JavaScript.
The volunteer-run project escalated from blocking package adoption to freezing the AUR write path after attackers abused trusted package workflows.
AUR recipes execute on developer machines that often hold source-control keys and cloud credentials. Attackers are turning trusted package ownership transfers into a distribution channel.
Arch Linux has disabled every push to the Arch User Repository, preventing maintainers from updating its community package recipes while the volunteer-run project removes malicious commits. The shutdown was amplified Sunday by International Cyber Digest, after Arch Linux DevOps contributor Robin Candau confirmed the freeze in the project's AUR mailing list.
"We have now disabled pushes altogether as well for the moment, while we handle the situation," Candau wrote on August 1st.
This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: runtimewire.com.
