On July 31, 2026, the Arch Linux project disabled AUR package adoption following the malicious takeover of over 200 packages. The malware, a Rust-based infostealer with SSH worm capabilities, uses Tor for C2 and targets crypto wallets, cloud secrets, and API keys.

A self-propagating **supply-chain** attack named **ChainDrop** compromised over **1,300 packages** on the **npm** registry on **August 4, 2026**. The infected packages accounted for **2 billion monthly downloads** and reached organizations including **Deliveroo**, **Qlik**, and **ServiceTitan**. Audit your dependencies now.