I posted a few weeks ago about putting the CachyOS Linux distro on my new computer build. It's still there but this morning I discovered the AUR has been infested with malware. The malware appears to be targeting older, abandoned software packages and does not appear to be affecting binaries, only source-code. The malware is going after unmaintained software by basically applying to be the new maintainer of the software, then adding new code to gather information via keylogging or other means once the "updated" software gets installed on end-users' systems. This means PKGBUILDs of AUR software should be done with caution, but updates of well-maintained packages and their binaries should still be ok.
So far several hundred software packages have been affected. That sounds like a large number but there's over 100,000 software packages in the AUR in total so it's really just a fraction of 1%, and as I said it appears to be unmaintained packages that are being targeted. Commonly used software usually does not have much trouble finding people to be maintainers so to be affected it sounds like you would have to have been a user of a little-used piece of software that has lost its maintainer. Assuming you still have the software installed you would presumably get an automatic notice of an "upgrade" to that software from the new "maintainer" (probably an AI agent) and if you went ahead and upgraded you would then be downloading and installing the malware on your system.
Note this is still something of an ongoing event so I may not be correctly describing the situation but that's how it appears to me at the moment. The best source I've found so far for keeping up with info on this attack is this AUR list thread, including this message containing a list of possibly affected packages.
For those unfamiliar with Linux, the AUR is the Arch User Repository, a collection of software source code collected and maintained by / for users of "Arch" (and Arch-based) Linux distros.
"Arch" is a linux distribution ("distro") that allows linux users to build their own system from the ground up. Arch starts with a minimal install of the kernel and utilities required to get a bootable and basically functional system going and then allows users to add their own bits of software to customize it for their own needs. Often a lot of that added customization comes from software contained in the AUR.
Arch-derived distros - such as the CachyOS that I'm using - provide the next level of functional build. In the case of Cachy that would be a system tuned for hardware performance, such as for gaming or computing throughput. Ideally in a user-friendly and system-oriented way that doesn't necessarily require users to be command-line gurus or concern themselves with inter-package software interactions. Though a little user knowledge about what's going on on their computer is never a bad thing either.