On 7/30/26, Robin Candau announced that package adoption on the Arch User Repository (AUR) has been temporarily disabled due to a surge in malicious package adoptions and suspicious commits. The Arch Linux DevOps team is actively handling the situation and urges users to report any suspicious activity that hasn't been addressed yet.

In a follow-up message, Candau confirmed that pushes to the AUR have also been disabled entirely for the time being. The team apologized for the inconvenience and promised to provide updates once the issue is resolved. Users are encouraged to remain vigilant and report any concerning adoption events or commits.

The temporary measures affect all AUR contributors and users who rely on the community-driven repository for Arch Linux packages. The DevOps team is working to identify and mitigate the security threats posed by the malicious activity. No timeline has been provided for when normal operations will resume, but the team has committed to keeping the community informed through official channels.