Arch Linux has pulled a user-provided AUR (Arch User Repository) package, because it contained malware. If you're an Arch Linux user who downloaded a PDF viewer named "acroread" in the short time it was compromised, you'll need to delete it. While the breach isn't regarded as serious, it sparked a debate about the security of untrusted software. The user repository included the acroread package, which had been abandoned by its maintainer. Someone using the handle “xeactor” adopted the package and modified it to download malicious scripts from a remote server. When that was discovered, maintainer Eli Schwartz reverted the commits, suspended xeactor's account, and discovered (and removed) two other packages with similar modifications.
A later post in the Arch Linux mailing list suggested the “attack” was a warning of another issue. As Bennett Piater wrote: “A script that creates 'compromised.txt' in the root and all home folders looks like a warning to me.”