AUR Packages Compromised with Infostealer and Rootkit

Over 400 AUR (Arch User Repository) packages were compromised by an attacker who impersonated a trusted maintainer and injected malware including an infostealer and eBPF rootkit through malicious npm and Bun dependencies. Arch Linux users are advised to check if they installed any affected packages, rotate credentials, and consider reinstalling due to the rootkit's potential to compromise system trust. AUR registration has been disabled as maintainers work to remove the infected packages.