Arch Linux disables AUR package adoption to stop malware flood

Attackers exploited the AUR package adoption process to hijack legitimate, trusted packages and inject two-stage stealer malware capable of stealing browser credentials, API keys, and establishing persistent SSH worm access. This incident illustrates a classic supply chain attack: rather than targeting end users directly, adversaries compromise a trusted distribution channel to reach a wide audience with minimal suspicion. The open, community-driven nature of AUR, while a strength for collaboration, creates an attack surface when package ownership transitions lack sufficient vetting. This matters because developers and system administrators who blindly trust community repositories can inadvertently deploy malware across production systems at scale.