Arch Linux: AUR pushes suspended - a silent incident affecting the entire ecosystem

The Arch team has stopped pushes to the Arch User Repository without any public explanation. There's silence on the reasoning, but the impact is real for everyone relying on `yay` and `paru`.

Facts

On August 2, 2026, a message posted on the aur-general mailing list simply announced that pushes to the AUR (Arch User Repository) are suspended. No public details about the cause were provided at the time of the announcement. The AUR is not frozen for reading—users can still install existing packages via yay, paru, and others—but maintainers can no longer publish new versions.

Context reminder: the AUR is a community repository (official Arch packages are elsewhere, in the core, extra, and multilib repos). In the AUR, each package is a simple PKGBUILD—a shell script describing how to fetch and compile the project—pushed by an individual contributor. A very open, fast model, but with a known attack surface: anyone can publish, and users installing are expected to read the PKGBUILD first.

Analysis

A global suspension of AUR pushes by the Arch team, without prior warning, does not happen for no reason. Reasonable hypotheses, without overinterpreting:

1. Ongoing security incident under investigation—compromised package, stolen maintainer credentials, or malicious automation. This is the scenario that best justifies a sudden cut without immediate communication (avoiding tipping off attackers).
2. Infrastructure issue—not ruled out (deployment bug, failed migration), but in that case, we’d expect neutral communication like “maintenance.”
3. Abuse of mass-upload/spam—less likely given existing protections.

Nothing is confirmed at the time of writing. The “shut first, explain later” pattern fits well with an incident response.

What to do now

For Arch / Manjaro / EndeavourOS users installing from the AUR:

• Do not keep running yay -Syu in a loop hoping it will unlock: the suspension is server-side.
• Audit what you recently installed from the AUR—if a package you use was published in the last few days by an unusual maintainer, take time to reopen the PKGBUILD and check what it downloads and executes.
• Wait for official communication before drawing conclusions about the cause. A post-mortem note will eventually be released (that’s Arch culture).
• Hygiene reminder: on AUR, yay -S <package> = “running unknown shell code locally.” Convenience never excuses skipping the PKGBUILD review for sensitive packages (drivers, network tools, auth wrappers).

Encadré - What to do now: do not assume a pacman -Syu has cleaned an AUR package. AUR packages do not go through Arch’s official repos and do not inherit their signing pipeline. If an incident is confirmed, remediation will have to be package-by-package.

We will update as soon as an official communication (mailing list arch-announce or Arch blog) is released about the cause and exposure window.