Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
Arch Linux has addressed a malware incident that affected over 1,500 packages in its user-contributed repository. The incident was initially believed to have compromised around 400 packages, but the number later rose to over 900 and finally to more than 1,500. The Arch Linux developers have deleted all the malicious commits they are aware of, but note that the list of affected packages may not be exhaustive.
- ▪More than 1,500 packages in the Arch Linux user-contributed repository were affected by the malware incident.
- ▪The incident was initially believed to have compromised around 400 packages, but the number later rose to over 900.
- ▪The Arch Linux developers have deleted all the malicious commits they are aware of.
Hacker News (Front Page) files mainly under programming. We currently carry 953 of its stories. Top-voted stories on Hacker News.
Story provenance
Source · retrieval · rights · ranking — open for full record
inspect →
Story provenance
Attribution is not the same as permission. This drawer separates discovery metadata, excerpts, WeSearch-generated summaries, reuse status, and whether the publisher receives the visit. Nothing here claims a legal grant the publisher has not made.
Record
| Original publisher | Phoronix |
| Canonical URL | https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500 |
| Publication time | Sat, 13 Jun 2026 11:55:30 +0000 |
| Retrieval time | 2026-06-13T12:33:54.534Z |
| Last seen | 2026-06-13T12:33:54.534Z |
| Headline source | Publisher (no WeSearch rewrite) |
| Excerpt source | publisher body |
| Excerpt method | First ~120 words (~800 chars) of extracted publisher body, fair-use limited. |
| Summary | WeSearch · cerebras-chat (WeSearch summarizer) |
| Summary source text | contentText |
| Citation coverage | Summary is a WeSearch-generated derivative; primary citation is the original publisher URL. |
| Cluster | wVpd7MEYc5cn · 2 stories |
| Cluster logic | Grouped by semantic title/content similarity across sources within a rolling window. Same-publisher template collisions are excluded from coverage comparison. |
| Ranking reason | Story pages are not engagement-ranked. Hub feeds use recency, with optional source-diversified chronological ordering (cap consecutive stories per source). No personalized ranking. |
| Publisher visit | Yes — open original |
| Substitutes article? | No — link-out required for full text |
Rights status (four layers)
WeSearch handling by dimension
| Indexing | May the item be indexed (stored, ranked, made findable)? | Allowed |
| Snippet | May a short excerpt of the publisher's text be shown? | Allowed |
| AI summary | May WeSearch generate its own short summary of the article? | Limited |
| Retrieval / RAG | May the content be exposed for third-party retrieval-augmented generation? | Not asserted |
| Model training | May the content be used to train AI models? | Not asserted |
| Commercial reuse | May the content be reused commercially? | Not permitted |
Basis: Derived from the published RSS/Atom feed. Contact: [email protected]. Reviewed: 2026-07-24.
Opening excerpt (first ~120 words) tap to expand
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages Written by Michael Larabel in Arch Linux on 12 June 2026 at 08:55 PM EDT. 37 Comments The day started out with Arch Linux's AUR user-contributed repository seeing more than 400 packages compromised with malware. Now in ending out the day they believe all affected commits have been addressed. But it ended up being more than 1,500 affected packages. It was bad enough when finding out more than 400 AUR packages for Arch Linux users had been infected with malware but now that number has risen to around 900 a few hours ago and now in the end at more than 1,500 user-contributed packages. In an update a few hours ago, it was believed around 900 packages were infected by malware in this week's incident.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Phoronix.