Malicious packages keep appearing in the AUR
Malicious and spam packages keep appearing in the AUR, and users have no reliable way to tell which packages are safe to install.
Tier I · Proven The best-established problems.
6 public reports · first reported 12 June 2026 · last reported 3 August 2026
What's going wrong
Users of the Arch community report repeated waves of malware and spam packages in the Arch User Repository.
AI-assisted: written with the help of AI from the reports. The idea report has the full summary.
In the idea report
- The full summary.
- The products the 6 reports are about, and how many came each month.
- Related problems.
No business has been found with this problem yet, so the report has no contacts. All sales are final — no refunds. Pricing.