158
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages
(www.phoronix.com)
this post was submitted on 13 Jun 2026
158 points (99.4% liked)
Technology
85390 readers
4200 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
A couple of weeks ago, some dingbat of an AUR admin orphaned a package of mine, ignoring the comment I left on it and my post to the mailing list.
Even though this package, to my knowledge, didn’t end up being attacked, I wonder if this was a potential precursor to the recent attack…
To answer your question, generally yes the package maintainer is the one who maintains the package for the current version of the distro, even if upstream is unchanged. If a package is no longer compatible and no one is making it compatible, then yes it's unmaintained and should be removed.
It wasn’t removed, it was marked as orphaned, which means anyone can take over and mess with it, lowering the bar for supply chain attacks.
If another user had said “I can take care of this long-term, gimme”, I’d had handed it over. Instead, some self-important dingbat with too many privileges decided to mass-mark all packages with an “outdated” flag beyond a certain age as orphaned, then ignored my mailing list post.
For what it’s worth, a distro package maintainer’s inability to update a package to a newer upstream version does not necessarily lead to a package being removed. Debian and Ubuntu kept shipping an ancient version of
freetdssometime in the mid-2010s and the package maintainer was incommunicado.