Omarchy Central reports that on October 15, 2026, DHH floated dropping AUR as an out-of-the-box option after a report of at least 15 malware-laden fake yay packages on the AUR. He also reminded everyone Omarchy already avoids AUR for installs and recommended options. At write-up time there was no PR removing AUR.
Question, not decision
That distinction matters. Expanding Omarchy’s own repo to cover what most people need is a coherent direction if the AUR keeps attracting lookalike malware. Until a PR lands, nothing changes in your menu. If you still use AUR on Omarchy, read every PKGBUILD, and treat near-miss names of popular helpers as hostile until proven otherwise.
Supply-chain theater is boring until it roots your box. Fake yay copies that pull remote code as root are exactly why “community repo convenience” needs adult supervision. Omarchy’s long move off AUR for stock installs looks smarter every time one of these waves hits.
What I would do
Stay on official Omarchy/Arch packages for anything that touches credentials, agents, or networking. If you need AUR, pin known-good maintainers and diff upgrades. Watch for an actual Omarchy decision — a tweet-shaped question is not a migration plan.
If Omarchy eventually hides AUR, power users can still add it deliberately. That is healthier than shipping a footgun next to “Install.” Convenience defaults should assume an inattentive Tuesday evening, not a careful PKGBUILD review.
Also rotate any credentials that lived on a box where you installed a sketchy AUR helper “just to try it.” Compromise theater often starts with a helper that looked familiar in the search box.
Have a blessed day!
My take? I’m all for making the AUR safer, but I want it to stay usable. Locking it down would hurt the folks who rely on it most. I’d rather see clearer warnings on risky or brand-new packages so you know what you’re getting into before you hit install.
And with AI moving this fast, I don’t think it’ll be long before AI can review AUR PKGBUILDs and the binaries they pull for us, flagging the sketchy stuff before it ever lands on our machines.