A one-week cooldown for AUR upgrades

Twice in the past year, installing an update from the Arch User Repository ( AUR ) could have handed your machine to somebody else. In July 2025 , three fake browser packages were uploaded which pulled in a remote access trojan (Chaos RAT ). They went up on July 16 and were removed on …