The Arch Linux project has suspended the registration of new accounts in the AUR (Arch User Repository) due to ongoing malicious code injections into packages and vandalism involving offensive language in Russian. After the initial mass attack, Arch Linux developers tried to defend against the issue through selective filters, but attackers circumvented these measures by replacing npm with bun and obfuscating their code calls in the post_install function. Registration will be restored after implementing more effective protection.
To hijack packages, attackers exploited the AUR's feature that allows taking over orphaned packages without maintainers. This feature was available without restrictions and checks to anyone willing to take it. Currently, there are 107,406 packages in AUR, of which 13,050 are orphaned (down from 15,261 a week ago). In the past week, 5,578 packages were updated in the repository, while 3,446 were updated the previous week. The repository has 141,967 registered users and 69 maintainers (last week there were 140,949 users and 69 maintainers).
Source: opennet.ru
