Arch Linux halts package adoptions after malware hijacking wave

Distribution Arch Linux has disabled package adoptions on the Arch User Repository (AUR) after attackers used the feature to push large amounts of malicious code through follow-up commits.

"Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation," Robin Candau, an Arch Linux DevOps team member, said.

Candau asked the community to report suspicious adoption events or unresolved malicious commits and to "stay vigilant".

It is the third AUR security incident since June this year.

A campaign Sonatype researchers dubbed Atomic Arch compromised more than 1500 packages in June, adopting orphaned listings to install a credential-stealing payload via a malicious npm dependency.

After that, a separate wave in mid-June saw more than 70 packages altered to insert Russian-language spam and profanity into users' shell configuration files.

Under Arch's package model, any registered AUR user can adopt a listing once its original maintainer has abandoned it, gaining full commit access to that package's git repository.

Attackers exploited that mechanism, with at least 27 packages being affected, as per a list compiled by AUR contributors.

Each compromised package carried a malicious ELF binary disguised with generic-sounding names such as "linter," "hasher" and "minifier."

Affected listings named in the thread include archutil, boringssl-git and icloudpd, though the list was explicitly framed as a snapshot as of July 30 and may not be final.

The Australian Cyber Security Centre (ACSC) has issued alerts recently on online code repositories being increasingly targeted by supply-chain attackers.

ACSC said the compromise of widely used trusted software packages presents a significant and ongoing risk for organisations. 

Arch Linux is a popular, minimalist free and open-source distribution that has formed the basis of others such as game software house Valve's SteamOS