Security
The Arch AUR Keeps Getting Hit With Malware, and the Fixes All Cost Something
On 13 October 2026 an account mass uploaded a pile of packages to the Arch User Repository that looked like the popular helper yay and ran code the attacker controlled as root the moment you installed them. It was the fourth malware wave on the AUR in about 15 months. I went through what actually happened, how the trick worked at the file level, and why the obvious fix is the one thing that would stop the AUR from being the AUR.