400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer

A significant security breach has rocked the Arch Linux ecosystem as attackers successfully compromised more than 400 packages in the Arch User Repository (AUR), transforming them into delivery vehicles for sophisticated malware designed to steal developer credentials. This massive supply chain attack highlights the inherent risks in community-maintained software repositories and represents one of the most extensive compromises of a Linux distribution's third-party package repository in recent memory.

The attackers hijacked numerous AUR packages and altered their build scripts to silently install a Rust-based credential stealer whenever any user built and installed these packages. The AUR functions as a community-driven collection of package scripts that allows Arch Linux users to compile and install software not included in the main distribution repositories. This breach potentially affects