I thought so.

Do you have any sources, links or evidence for your statements?

Who’s “they”? Because it’s not Arch. Arch doesn’t want to have anything to do with AUR, and neither does any of the Arch-derived distros. They’re all perfectly happy taking advantage of it, of course, but not the responsibility.

Where did you got this nonsense from? What do you mean “they are not Arch”? The AUR is managed and operated by the Archlinux team. As the packages are community-driven content, they cannot guarantee and give support, because it is not their package. But they are still managing and supporting the AUR itself.

• https://archlinux.org/news/active-aur-malicious-packages-incident/ from 2026-06-12 is an official message on the main Archlinux website (there is no new post about the current situation).
• from https://archlinux.org/people/package-maintainers/ : Campbell Jones is an AUR Moderator
• from https://archlinux.org/people/support-staff/ : Andrea Denisse Gómez-Martínez is an AUR Packager, Robin Candau is an AUR Moderator

Well, it was completely down in the sense that no operation was possible on the webpage. The page was just a single error code, so nothing to sign in possible. At least for me in Europe, the page and servers was out of service for about 7 hours or so (I tried over and over again, matching the experience with the graph). Maybe there were servers that was not affected at the time you logged in.

Yeah looks like its been a problem since last month, according to this graph. Today was the worst being completely shutdown for hours.

This is actually one of the reasons why I don’t like the way some do their posts (I don’t mean cross-post, but normal post). Instead a link to the article or whatever they are linking, an image is uploaded, and they link to the main article in the body text. This will prevent the Lemmy system from automatically connecting all articles. So it does not matter if the post is shared with cross-post or created from scratch, if they link to an article with the same address, then the Lemmy system will recognize the same article and connect them in the outer list, across all Communities. I really love this feature!

I’m glad this helped in understanding. And also thanks for updating the post.

OK, that’s a good point. It would prevent auto updating.

Weren’t there “sleeper accounts” registered years ago that became active in the current wave?

Which does not invalidate my point about new accounts, but yes. Its important for new accounts, so once a sleeper account is banned, its not that easy to just create thousands of new accounts while everyone is focusing on the current active ones. And if, as I suggested, mass adoption per account is not possible, then the attacker has less to attack.

Edit: They need to make sure that sudden editing many packages in short time, with probably the same or similar lines should be automatically reported. They need some automated checks in place, at the very least. This would be a very suspicious behavior if many accounts are not active, and then suddenly all of them do something.

Even experienced people will just update as if nothing could happen.

Then you can’t fault the system, if you are this reckless.

Adopted packages should have to use a different name and the current name being blocked so it WILL get attention when some tries to update their system.

This would break all dependencies of this package. The point of adoption is to keep it working and stable. I’m highly against force changing the name, that is not a solution (at least not one I am happy about).

Besides all the other non infected ways to install the software, there is a way to prevent this: Just read the AUR package before install and don’t trust blindly any new maintainer.

You mean https://aur.archlinux.org/packages/deepseek-tui-git from the list https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/P4WIRHTFNH2YZWQHGBAKQWX5YOAFIDLY/ ? It has 0 votes and Popularity is at 0.000000, since it was uploaded 2 months ago. And there is a non Git version that is not listed (probably not affected) at https://aur.archlinux.org/packages/deepseek-tui . On top of it, on their website https://deepseek-tui.org/#install the main recommended way to install it is with npm and there is even a way to build it with Rust it seems (I’m a bit unsure).

So I don’t think it hit that many users, as only a couple of people since Mai would want to install it, and they have to have updated it to build from source in recent days. That is a very narrow number of people, just by my gut feeling.

Adoption of unmaintained packages to maintain them is not a mistake. The problem is the current implementation, not the idea behind it. It’s like saying the AUR is a mistake, because some people do malicious stuff.

They should find a better solution, like adoption shouldn’t be granted to everyone without question, especially new accounts who didn’t maintain anything before. Mass adoption shouldn’t be granted automatically (limit rate), in example 1 package adoption per day and if someone wants more, admins or moderators need to approve. And updates of newly adopted packages should wait a day.

Also the AUR helpers should do a better job. Always ask if a new adopted package should be updated and give a warning the maintainer changed.

It’s happening!

I’m not from the US.

Lastly, the links inside the body show only on one of the cross-posts, but the ones outside the body show on both cross-posts.

The outer list is automatically generated and every post to that link will appear in this list, even years later. Its pretty cool, but nothing new, we had that back in Reddit too. When Reddit existed. The post content is just a link added once. When I do a crosspost, then the content of the original post is added automatically too. This is only one source where the original post was shared from, and will not automatically update (unlike the above outer list). I assume it depends on the software they are using, when generating the crosspost. The post body is managed by the user and the app they are using to generate the content, which is a normal link to the web like any other. The above list is managed by the Lemmy system and out of our control. So it can do the optimized linking with short style automatically.

HAHAHAH… you serious?

You really think Nintendo invented this style of logo creation, with the main title in big and a bottom subtitles, and the font in Red. This logo doesn’t even look like SNES logo. Oh wait, every company stole the SNES logo, because it has letters in red in it! Oh yeah how could I forgot that. Now when I look the images side by side, I realize that I should have named the files accordingly, because I forgot which one is the original. Have a look:

Why would anyone buy a game, because of a company logo?

You don’t need explicitly Valve-endorsed cards.

I don’t think this is your decision what I need. I don’t need your endorsement to use what I want.

It’s not whatever. Buying cards in a shop without having a bank account or credit card usage is a big deal. This was and currently is my main way of buying games in Steam. It is whatever to you maybe, but not to me.

In short, Valve is discontinuing physical Steam Gift Cards. They already stopped producing them and they expect the stock will run out at the end of 2026. I assume they talk about their own stock, so your shop may still have some even next year. One of the best things of Steam comes to an end… Edit: Reduced noise.

More information directly from Valve: https://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59#retailers

Here in Berlin, Germany they aren’t rare yet. Currently I’m purchasing them from time to time before they completely vanish.