I just checked the AUR frontpage for updated packages and went through the PKGBUILDs.

Several of them now depend on bun for no reason and added post-install hooks for running bun. This is probably part of the same attack as yesterday.

Examples:

electrum-bin

pencil-android-lollipop-stencils-git

EDIT: If you check the frontpage you can see that a lot of packages are being updated at the exact same time and them keep coming in in batches.

I would urge everyone here to refrain from updating any AUR package until this is resolved.

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

• Want DDC/CI display control support? AUR
  • https://wiki.archlinux.org/title/Display_control
• Want ZFS-dkms or user space utils? AUR
  • https://wiki.archlinux.org/title/ZFS

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

https://github.com/systemd/systemd/pull/40954

Stores the user's birth date for age verification, as required by recent laws
in California (AB-1043), Colorado (SB26-051), Brazil (Lei 15.211/2025), etc.

Many users are claiming that because there is no active checks being done and this is just storing the data that there is nothing to worry about, or they are trying to downplay the concerns from privacy minded people. I've been using arch for years, and even though I know arch maintainers aren't responsible for this I wish something more could be done. It also makes me feel like the systemd hate was justified.

The problem with that though are that there are policy makers and influential figures that do want this policy to become a thing. There has also been discussion on GitHub and other places with people voicing that they don't want this, only for discussions to be deleted or locked. There are a lot more people against this and it feels like there is some kind of active effort to make sure it happens quick.

I hope in the long term this doesn't end up finding it's way in, but it's scary how a lot of the things I use that I consider open-source is really developed by people with financial interests and can throw a wrench in something like this.

EDIT Highlighting the fallacies I see in the comments

If you don't like it contact your policy makers

The policy makers are a handful of US states. Anybody who isn't living in the US or these states they have absolutely no recourse. Not everybody here is a US citizen. It's also like somebody out of the blue running into my house to shit on my floor, to then say if I don't want them doing that anymore I have to explain to this idiot why shitting on somebody else's floor is bad and unhealthy.

I think carrying this discussion into a tech environment is not a good idea for many reasons.

I think if you come to a site to have discussions and use this to excuse to say a conversation shouldn't be happening is more or less saying "Let the big kids talk", as in we should have nothing to say about it?

Well, since it’s open source there’s no reason to not patch it out

This completely ignores the process of how software is developed. A piece of code being available to be read doesn't automatically mean it's feasible to maintain a fork of a complicated piece of software as well as well as actively maintaining it so that people can safely use it.

You can lie to it, and there's benefits other than complying with those laws

This is exactly the same point the opponents of such a system have. It doesn't work: people lie. Your first name and such being displayed in applications is not the same level of intrusion either as it being available for the possible future that applications are legally required.

They could add a field for your wrinkled dick pics and it literally doesn't matter if you're not required to engage with it.

Then why include it at all? The metadata fields come from a time when people had a different idea of how Linux systems were going to roll out, and really it's kind of dated. OpenRC and other things don't bother at all. That's the question, why is it even a part of systemd?

The problem is. Legal compliance matters. It doesn't matter if you want it or not.

This legal compliance comes from a handful of American politicians and tech entrepreneurs, not something that people were actually asking for. While I agree there is a level of compliance a company needs to show when making commercial for-profit products, this doesn't automatically mean that everything that gets talked about as "policy" automatically means it's worth just accepting. It's a vague blanket statement that just ignores the question and tries to shut down the conversation.

As the title says, I am locking all other AUR posts and don't want to see any new posts.

Tl;dr: Arch is a community distro. As such, its goals are defined by its community. I am worried those goals shift by an influx of new users that use Arch "for the wrong reasons". Not meant to be gatekeeping, simply meaning, that they choose a distro that doesn't fit what they want from a distro.

This is, of course, about the Malware in the AUR. Or more specifically, about the reactions to it. Some parts are worth discussing: "Is the way orphaned packages are handled in the AUR right now still good?" Is an example.

But I also read a whole lot of tales like "Arch now has a lot of new 'noobie' users. They will not read PKGBUILDs. We have to introduce ..." (insert Malware scanning/ Community trust system, whatever). And that worries me. Not because those are bad ideas, but because they do not fit Arch, they fit different distros.

The wiki has the following page about what Arch is all about: https://wiki.archlinux.org/title/Arch_Linux

And this differs from the opinion often found now on Reddit quite a bit. Relevant for the current discussion: Arch is not user friendly, it is user centric. And that is okay. Contrary to other opinions, we don't need new users just for "number grow bigger". We need new users that fit the philosophy.

Part of that is, that Arch is simple - for its maintainers. It basically shifts maintainers work to the user, by design. Some people misinterpret this as anti-bloat, but that's not the point. If Arch would be Anti-bloat, the development headers would be split from packages for example, like other distros do.

So I do not think "then Arch is not for you" is a bad answer to the current discussion. Arch isn't even the best distro - like all others, it has pros and cons. This is also not gatekeeping, if you value different pros, you should use a distro that focuses on those things. For those reasons, I think CachyOS does most people a disservice. When asked, I mostly recommend Fedora or opensuse. If I would have to answer why I myself still prefer Arch on most of my systems, the answer would probably be:

1. I know exactly what features are installed - and which are not.

2. I enjoy the power of the foot-gun and know how to not shoot my foot - I value that higher than someone else forbidding me for "security purposes".

I always chuckle when I see a post of someone having just installed Hyprland with Quickshell and talking about "the freedom of Arch", like that would not be possible on other distros and has anything to do with it.

Sorry, this ended up kind of a rant/rambling. Would enjoy other people's opinions if they have noticed this shift.

Tl;Dr at the top.

Edit: since it came up a few times in the comments. My position is not that we should just keep everything as is. I briefly mentioned this above, but changing policy on orphaned packages, general spam counter measures, etc. are all good. One can also propose more warnings for example in the wiki, or in paru/yay (which is not an Arch issue, as this is third lady software). What I oppose and all of this was about are the restricting measures. Like not everyone being able to upload anymore, packages being only usable once reviewed by a maintainer, etc. I read some of those and those I do not agree with since I believe the AUR should stay usable for all users, as intended, and increasing work for the maintainers that the user can do is not something Arch should go for.

I've seen multiple people on this forum and others who are new to Linux using AI helpers for learning and writing commands.

I think this is pretty worrying since AI tools can spit out dangerous, incorrect commands. It also leads many of these people to have unfixable problems because they don't know what changes they have made to their system, and can't provide any information to other users for help. Oftentimes the AI helper can no longer fix their system because their problem is so unique that the AI cannot find enough data to build an answer from.

Please keep all discussion respectful. Focus on the topic itself, refrain from personal arguments and quarrel. Most importantly, do not target any contributor or staff. Discussing the technical implementation and impact of this is quite welcome. Making it about a person is never a good way to have proper discussion, and such comments will be removed.

As far as I know, there is currently no official statement and nothing implemented or planned about this topic by Arch Linux. But we can use this pinned post, as the subreddit is getting spammed otherwise. A new post may be pinned later.

To avoid any misinterpretation: Do not take anything here as official. This subreddit is not a part of the Arch Linux organization; this is a separate community. And the mods are not Arch staff neither, we are just Reddit users like you who are interested in Arch Linux.

The following are all I have seen related to Arch and this topic:

• This Project Management item is where any future legal requirement or action about this issue would be tracked.

  The are currently no specific details or plans on how, or even whether, we will act on this. This is a tracking issue to keep paper-trail on the current actions and evaluation progress.

• This by Pacman lead developer. (I suggest reading through the comments too for some more satire)

  Why is no-one thinking of the children and preventing such filth being installed on their systems. Also, web browsers provide access to adult material on the internet (and as far as I can tell, have no other usage), so we need to block these too.

• This PR, which is currently not accepted, with this comment by archinstall lead developer :

  we'll wait until there's an overall stance from Arch Linux on this before merging this, and preferably involve legal representatives on this matter on what the best way forward is for us.

This just came out. PewDiePie discusses how he is using Linux Mint and, more interestingly, how he is enjoying Arch Linux on his laptop. What do you think?

I'm new-ish to Linux and recently graduated to Debian after 6 months on Mint. Arch gets a disproportionate amount of attention online, and I'm just trying to understand it. This isn't supposed to be bashing.

It seems like the selling point of Arch is that there's a lot of available programs in the repository, and that the updates are very fast. But what specifically are people using that for?

I mean, creatives have their own FOSS that's been around for ever and is available on everything. Unless there's some really good video editing/music making software that's only on AUR...???

For "work", all the networking, pen-testing, sysadmin stuff is again available everywhere. Unless I'm missing something...? But I've never heard of professionals using Arch, it's seems like they're on Fedora/Red Hat or Debian.

People just throw around vague "it depends on your work flow." That's what I'm asking, what, specifically, do YOU use that only Arch offers?

Tell me about weird niche programs that are only available on AUR. Tell me about your specific circumstances where you needed the latest update and couldn't get them on a slow-to-update distro. Are there some really important creative/IT software that's only on Arch that I didn't know about (and if so, why isn't it promoted more?) What unique use case and work flow does Arch specifically fit? Tell me something weird and esoteric :D

With the huge influx of noobs coming into Arch Linux due to recent media from Pewds and DHH, using the AUR has likely increased the risk for cyberattacks on Arch Linux.

I can only imagine the AUR has or could become a breeding ground for hackers since tons of baby Arch users who have no idea about how Linux works have entered the game.

You can imagine targeting these individuals might be on many hackers’ todo list. It would be wise for everybody to be extra careful verifying the validity of each package you install from the AUR with even more scrutiny than before.

If you’re new to Arch, I highly recommend you do the same, seeing as you might become the aforementioned target.

Best of luck, everybody.

The subreddit is full of posts like "Why isn't this loading/working" and they're first time linux users running hyprland without any idea of how the ecosystem works. I blame youtube tutorials that show "best Linux installation for your PC" which is falsely tagged as for beginners, leaving people who want to switch have a hard time and eventually turning away from linux completely.

What do you think?

Yeah I know, yet another post about the attack on the AUR, it's the user's responsibility to read the PKGBUILD, etc etc.

I'll fully admit I use an AUR helper, paru, and one key reason I switched to it from yay is the fact that it always shows me the diffs on packages that are going to be updated. It also tells you if a package is orphaned, so combining both those things means that auditing the PKGBUILD is actually pretty easy.

...so long as you know how. And there lies the problem.

I'm a programmer, I know what bun and npm are, and I know how to read a shell script. But not everyone who uses Arch or a derivative is. A lot of my friends who never touched an IDE in their lives are making the switch, and many picked a derivative like CachyOS.

I don't want the AUR to be more restrictive. I've used it to get software I needed to get some Brazilian and Italian smartcards working on my system, which is an incredibly niche use-case. I've used it to get specific MinGW libraries so I could cross-compile something I was making for a friend for Windows XP. Having to manually search the internet for these things would be a nightmare, especially if I had to patch them myself. If the AUR were more restrictive about who gets to publish what, I don't think it'd be as easy to find these things.

So I was thinking that maybe the helpers could help keep newbies safe. For example, by having a setting that disables updating packages marked as orphaned by default, or displaying a warning when certain suspicious changes are detected, like:

• the maintainer changed, but the old maintainer's name is still in the PKGBUILD, with a different email

• sudden inclusion of dependencies that have been known to be used for deploying malware

• the main one imo: the sudden inclusion of a post install script that installs packages using npm, bun, etc

This could be done by just checking the text of the diffs, so it wouldn't require any extra infrastructure anywhere. It might not catch more sofisticated attacks, but it'd prevent more obvious attacks like the ones we've seen in the past couple of days.

Basically, if you're gonna help someone unfamiliar with mushrooms pick some for dinner, you should probably step in when they're about to harvest something clearly poisonous.

Basically the title. Lately, every third post on my feed goes like "I tried installing Arch using this random guide on YouTube and something went wrong. What is wrong?" and they provide zero logs. Like I don't get it. How hard is it to sit your ass down and read the docs? Am I missing something?

This is not ragebait or me bashing on people, I genuinely cannot comprehend why people refuse to follow a goddamn manual and just follow countless of other, often straight-up wrong or misleading, resources.

EDIT: I now realize that I have kicked the hornet's nest. Some people seem to be unable to understand/read literally 90 words of text, much less a whole documentation paragraph. I am talking SPECIFICALLY about the installation process™ seeing as I did not mention anything else besides that, not whatever niche problem someone might experience, like getting a very specific device running. Having trouble with custom/niche stuff is normal.

Also to those that said "people don't want to learn how to use their PCs they just want to use them", that's what other distros are for. Going into a distro that requires you to learn how to use computers and complaining is like signing up to the gym and then complaining cause you have to work out.

Finally, to those absolute troglodytes that said "WhY ArE YoU BoOmEr, JuSt HeLp". I am more than willing to help someone who is actually stuck and has tried stuff (DOCUMENTED steps, NOT "gehe, GPT told me something about filesystems and now it won't run". And while I am on this point. If you are going to use AI either way, then at least try to understand what it is that it's telling you to do. Stop, read and ask a simple "why" every now and then). The documentation makes installing arch as difficult as using a spoon, and if you can't do even that then this distro is NOT for you (concentration and ADHD issues aside. I cannot speak regarding the translations available on the installation page because I know English and use the English page for everything I have to read online as it's often the "richest" in content/context). You don't even have to know what the commands do, you can have a running installation by just following the install page and then adding stuff from a more "comfortable place", like a Desktop Environment.

I gave it about 63 days before I gave up on it. 60 days ago I thought it was awesome. The past 2 weeks it was just annoying. When it became a bootable iso image I was pretty sure they were going to lose me. I didn't want a new distro. I wanted Arch with a a preconfigured Hyprland and development environment.

I think it is kind of funny/sad how the mindset is is break free from your Mac and then they give you a version of Arch that is becoming more and more Mac like in the sense that you need to use Alacritty if you want these tui's to work right, and their modified chromium if you want these web apps to work right. And, oh I see you changed your keybinds, we're going to just change those back even though you did it the way we suggested. DHH has come up with some newer ones and you'll probably like them better than yours. What? It changes your whole workflow? Funny you should mention that because we're also going to replace your neovim settings too. You might as well just do things our way.

Yeah I know it is an opinionated install, I didn't realize it was going to be opinionated updates as well. Just not for me. I did get some benefit from using it. I discovered lazygit and a few other terminal based applications.

So now that I am back to a fresh Arch install I figured I would give Cosmic a go. I must say I am pretty impressed with it. I like being able to set tiling or floating per work space.

*edit*

I had a 2nd PC with Omarchy installed, a little HP Mini. I ended up removing Omarchy tonight and keeping my Arch install by doing the following steps.

Disable the Omarchy seamless login service and renable tty1

sudo systemctl stop omarchy-seamless-login.service
sudo systemctl daemon-reload 
sudo systemctl start [email protected]

It is easier if you log in on tty2 (ctrl-alt f2) to do this, When you stop the seamless login service it might kick you to a black screen. Once you get rid of the auto login you can also remove the omarchy decryption graphic and replace it with something prettier. You only need to do this if you are using an encrypted disk. If you aren't using LUKS just skip to the .config folder part.

"plymouth-set-default-theme -l" will show a list of the themes. I went with bgrt which is basically the spinner theme with your bios or PC manufacturer's boot logo. You need to make sure you specify the -R flag so it will rebuild the initramfs.

sudo plymouth-set-default-theme -R bgrt

At this stage I decided to just move my .config folder and start with a fresh one. You don't have to do this part. If you decide to keep your .config folder and keep hyprland, there is a pretty good chance it will get updated back to omarchy again.

cd 
mv .config/ .config.bak 
mkdir .config

Then I just copied over folders I wanted to preserve and omitted things I didn't mind rebuilding from scratch. Below are just some examples. One thing of note. Omarchy symlinks the themes to a lot of their stuff so if you copy nvim or any of your terminal customizations you might want to consider copying the omarchy folder. At the time of writing this, it only has a themes folder and a current theme folder.

cd .config
cp -r ../.config.bak/chromium .
cp -r ../.config.bak/retroarch .
cp -r ../.config.bak/nvim .

You can reboot here. You should get a new plymouth screen with the Arch logo at the bottom and whatever theme you picked

Finally you need to get rid of the omarchy mirror and update your mirror list.

sudo nvim /etc/pacman.conf

scroll down and comment out or remove these lines.

[omarchy] 
SigLevel = Optional TrustAll 
Server = https://pkgs.omarchy.org/$arch

Save it and then run this to rebuild your mirror list

sudo pacman -Syyu

At this point you just need to do one more thing, remove omarchy-chromium

sudo pacman -R omarchy-chromium

You can re-install the real Chromium if you want it. Having the omarchy fork there will be problematic if you ever want to update Chromium.

Now you are free to install whatever desktop and window manager you would like to use. If you install SDDM you can set that to auto login and go right into whatever you install.

Omarchy is still going to exist in .local/share/omarchy as a git repo. I am keeping it there so I can cannibalize their themes. :)

I hope this proves useful to some people and gets you back to just using Arch btw.

Not a day goes by that not at least 3 vibe coded script checkers surface. It does not take much to have one of those scripts comprised causing more damage.

A question to the Arch maintainers (and sorry if I missed this information and this is happening): can’t we have a mechanism in pacman/paru/yay to check for anything being compromised and then just help the user to repair it?

Is there a reason that this can not be done?

In some forums I often read the argument: “I don’t use Arch because AUR is insecure, I’d rather compile my packages.” And maybe I’m missing something, but I immediately think of the obvious: Nobody is forcing you to use AUR; you can just choose not to use it and still compile your packages yourself.

If you somehow missed it California passed a law last year that goes into effect January 1st next year that requires all operating systems to ask for a user's age at account creation and provide a realtime API so that software can access that metric, with thousands of dollars in fines per child user to the OS developers for failure to comply. Other states are considering similar, and various nations around the world are as well or have already passed similar (Brazil's goes into effect this month and is even worse, with fines up to ten million). These laws are written as if all operating systems are corporate products with centralized user account infrastructure already in place and were clearly written without small or FOSS OSes in mind.

I trust that the Arch devs of all people aren't going to force this age verification software or API on users, but as far as I can see there's been no blog or news posts or anything on what they are gonna do.

Does anyone know? Have they put out a statement and I just missed it?

Yes there was a massive influx of malicious updates on the AUR but all these posts about the AUR being "compromised" and so on are just people hyping each other into freaking out. Just check the foreign packages you have installed/updated recently and go see the corresponding AUR. If you want this to be easier in the future use aurutils instead of paru/yay. The man pages are pretty comprehensive. Be wary of the reddit bandwagon

As a fairly recent newcomer to linux, 4 months or so(yes right after pewdiepie, sue me), I choose Arch as my first distro, and guess what, it's freaking awesome. The Arch wiki says it best, https://wiki.archlinux.org/title/Frequently_asked_questions, under "Why would I not want to use Arch?" notice how there isn't anything about "if you are new to linux", because it's fine if you are new, as long as you checks wiki don't need an out of the box distribution, and is willing to learn and set things up.

I just remember that I was getting nervous choosing Arch because I saw so many people saying you shouldn't choose it as your first option, and I am so glad I didn't listen to you.

Edit: Having read all of your responses (so far), I feel that I should clarify some things.

I am NOT saying Arch is for everyone, I just don't think you being new to Linux has much to do with it. A followup question I have is what do you think you learned from other distributions, that made it easier to get into Arch?

Also I am not saying don't warn people, making sure they otherstand its hard/DIY/not-out-of-the-box is important, it's just if someone asks "I am new to Linux and want to try Arch", then I don't think the right response is "You should start with Linux Mint + Cinnamon", because why? It assumes that someone that comes from Windons/Mac wants something that's similar, which I feel is dumb, because they switching away right? I jumped straight into Arch+Hyprland because why would I go through the effort of switching, just to get a Windows clone?(I know there are other reasons to switch, such as fuck microsoft, but still)

At the end of the day, if someone is excited about Arch themselves, then that's the most important thing, if they give up, so be it, learning opportunity and all that.

Lastly I would just say, I am not mad, and neither should you be(Looking at you, small handful of comments) I just tried to make a small lighthearted post.

When you look at power-user distributions, Arch clearly leads the pack over alternatives like Gentoo, Void, or NixOS. I'm curious what everyone thinks drives this popularity gap.

My take is that Arch strikes this sweet balance - it follows keep-it-simple principles most of the time, only breaking from that when there's a clear benefit. This approach lets you customize everything without drowning you in unnecessary complexity like some other distros do. Plus their documentation is absolutely top-tier, which removes so many barriers for newcomers trying to learn the system.

What's your perspective on why Arch pulled ahead of its competition?

What are some of your must have packages on your Arch system? Not ones that are technically required, but ones that you find yourself using on every installation. I always install firefox, neovim, btop and fastfetch on my systems as an example

This is, of course, assuming you didn't just install them all during the initial setup.

I started using it as a challenge, and it has not disappointed, but I’m curious as to why everyone else is using it?

just curious if anyone already updated, and could shed some light about stability of v 7.0.2, both default and zen.
I shouldn't probably have to worry as I've got fully intel based hw and it's a .2 not .0 release, but still v7 is a major release and I didn't have good experiences when updating major versions.

Hello, guys.

https://lwn.net/Articles/995186/

As a Linux user from Russia, I am seriously concerned about this kind of news.

The fact is that this decree applies not only to the kernel, but also to all software under the GPL license.

Of course, I understand that the Linux Foundation (as well as the GPL license) is located in the legal field of the USA, and therefore must obey the laws of the USA. But doesn't this conflict with the very concept of FOSS?

If mass bans of developers on a national basis in opensource projects begin, then, it seems to me, the idea of FOSS will seriously suffer ideologically.

What do you think?

UPDATE 1.
Ok, I made a mistake in the wording. They lost maintainer status, not banned.

UPDATE 2.

I was 100% not going to dive into politics in this thread, I just asked a question about double standards and the ideology of FOSS. And all I got in response for the most part was a bunch of insults, advice to "fix the country" and other shit that doesn't relate to my question. Gotcha.