Arch User Repository
Ranked 3 of 9 package repositories by recommenders
Community repository of build scripts that makes software easy to install on Arch. Most common caveat: packages are not vetted, and supply-chain attacks have hit it recently.
Community repository of build scripts that makes software easy to install on Arch. Most common caveat: packages are not vetted, and supply-chain attacks have hit it recently.
43 people gave an opinion
- recommend it
- 20
- criticize it
- 23
- approval share
- 47%
Recommended in 10 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 20 people recommend itNeeds 10 or more, met.
- 0.8 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 10 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Easy access to extra software
“manage to get an AUR build working, my life is pretty good”
Comment from 27 Jan 2026 in “The C-Shaped Hole in Package Management” “the wiki, and the AUR are the two killer features”
Comment from 15 Feb 2026 in “I love the work of the ArchWiki maintainers” “Excellent software availability through AUR”
Comment from 10 Feb 2026 in “Simplifying Vulkan One Subsystem at a Time” - Comment from 20 Oct 2026 in “NixOS is making me less afraid”
- Comment from 13 Aug 2026 in “Single log line is 49KB+ (ext4) / 110KB+ (btrfs) of systemd-journald disk writes”
Big productivity boost for users
“AUR is a massive productivity boost.”
Comment from 18 Nov 2025 in “Windows 11 adds AI agent that runs in background with access to personal folders” “aur make things so much easier”
Comment from 13 Aug 2026 in “Single log line is 49KB+ (ext4) / 110KB+ (btrfs) of systemd-journald disk writes” Build scripts can be inspected
“Even the aur repository helps you alot, by checking the raw scripts”
Comment from 15 Feb 2026 in “I love the work of the ArchWiki maintainers” “with AUR (depending on tools) allows you to inspect the PKGBUILD”
Comment from 20 Jun 2026 in “AURpocalypse now: a look at the recent AUR attacks” Seen as Arch's standout feature
“Arch is the only one that does it “right” with the AUR.”
Comment from 1 Jun 2026 in “NPM packages from RedHat have been compromised” “the wiki, and the AUR are the two killer features”
Comment from 15 Feb 2026 in “I love the work of the ArchWiki maintainers”
What people warn about
Each mark is one comment
Packages unvetted, anyone can publish
“AUR is worse, in that there may not be official authors and you can take over releases of a package.”
Comment from 13 Jun 2026 in “Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages” “It's really only arch with the AUR and some others where completely untrusted packages are used.”
Comment from 22 Jul 2026 in “LG to Ban Residential Proxies from Smart TV Apps” “a free for all like the Arch AUR, except the audience includes people who are new to Linux”
Comment from 26 Aug 2026 in “Omarchy development practices lead to predictable security issues” - Comment from 22 Jul 2026 in “LG to Ban Residential Proxies from Smart TV Apps”
- Comment from 23 Jun 2026 in “Package Managers need global hooks”
Recent malware and supply-chain attacks
“No other package manager this regularly has hijacking problems.”
Comment from 13 Jun 2026 in “Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages” “We've seen an increase in hijacked packages installing malware.”
Comment from 28 Mar 2026 in “Don't YOLO your file system” “the AUR has recently suffered multiple supply-chain attacks”
Comment from 8 Aug 2026 in “The Nixpkgs core team has disbanded” Design leaves users exposed to risk
“the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over”
Comment from 2 Aug 2026 in “Pushes to arch AUR are suspendended right now.” “its design and the way package maintainership works puts users at undue risk”
Comment from 20 Jun 2026 in “AURpocalypse now: a look at the recent AUR attacks” “the issue you had with AUR is one that by design could be completely avoided”
Comment from 29 Jun 2026 in “NixOS 26.05 Released” Advised against production use
“I try very hard to avoid the AUR and only use it as a last resort”
Comment from 30 Aug 2026 in “Omarchy: Any User Process Can Escalate to Root” “running your production code base against Arch AUR pkgbuilds”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan”
Other package repositories people recommend
The four most recommended other package repositories, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Nixpkgs | 38 | 22 | 63% | 11 | — | — |
| Arch User Repository | 34 | 74 | 31% | 5 | — | — |
| Arch User RepositoryThis page | 20 | 23 | 47% | 10 | — | — |
| crates.io | 17 | 18 | 49% | 9 | — | — |
| PyPI | 16 | 28 | 36% | 10 | — | — |
What people said
40 of the 45 comments that mention it, newest first. Each links to the original comment.
“pacman and AUR are just so peak”
“I try very hard to avoid the AUR and only use it as a last resort”
“a free for all like the Arch AUR, except the audience includes people who are new to Linux”
“aur make things so much easier”
“the AUR has recently suffered multiple supply-chain attacks”
“the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over”
“It's really only arch with the AUR and some others where completely untrusted packages are used.”
“The AUR is unofficial and not properly vetted in the same way as the actual Arch repos”
“the issue you had with AUR is one that by design could be completely avoided”
“I hope official, veted Arch repositories grow over time.”
“The recent AUR plague is actually a symptom, to me.”
“It was only the AUR that was compromised.”
“free for all anything can happen, any kid can publish”
“its design and the way package maintainership works puts users at undue risk”
“with AUR (depending on tools) allows you to inspect the PKGBUILD”
“didn't implicitly trust anything as loose as the AUR”
“the AUR really is pretty much uniquely bad here”
“a deliberately un-vetted pile of random Git repos”
“No other package manager this regularly has hijacking problems.”
“even when trying to put malware into Arch Linux AUR”
“AUR is worse, in that there may not be official authors and you can take over releases of a package.”
“if they require updates too frequently or they want a slew of other AUR only packages as dependencies”
“Any review process is more than the AUR and NPM are doing.”
“Arch is the only one that does it “right” with the AUR.”
“Wait until you find out that Arch has both secure boot and the AUR.”
“AUR packages are a complete wild west.”
“NPM (and AUR et. al.) are providing herd protection that the script-paste hole does not”
“AUR which is just glorified curl | bash”
“running your production code base against Arch AUR pkgbuilds”
“We've seen an increase in hijacked packages installing malware.”
“a long history of people writing their own package specs (AUR)”
“If you build and install packages from AUR”
“Even the aur repository helps you alot, by checking the raw scripts”
“the wiki, and the AUR are the two killer features”
“Excellent software availability through AUR”
“I feel like I'm the oddball out about the mess that is AUR”
“manage to get an AUR build working, my life is pretty good”
“This seems to not have the issues in the examples given so far, which come from using "monorepos" or colocating.”
“AUR is a massive productivity boost.”
“making it past 5 sudo pacman -syu iterations without an AUR package going thermonuclear”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.