Using Pamac
The Manjaro package manager - Pamac - is very popular with various Arch Linux based systems.
At the time of writing this, 2026-08-04T22:00:00Z, the pamac-aur buildscript has more than 400 votes for inclusion in the official Arch Linux Repo.
The major reason for the popularity is the ability to integrate custom scripts from AUR into your normal maintenance workflow.
This can be outright dangerous for inexperienced users of the Manjaro package manager on all Arch Linux derivatives.
The advise: Only enable AUR when you need it. Disable after use.
From Official Repo To AUR
This usually happens upstream at Arch Linux official repositories, but packages may also be dropped from Manjaro Linux repositories, only they are not added to AUR.
For various reasons a package may become obsolete and therefore removed from the official repo. An example of such obsolete packages was when qt4 was dropped.
When this happens the original Arch Linux PKGBUILD is commited to AUR and marked as an orphan.
Such package can be adopted on AUR and maintained by the community, if there is a community demand for it.
What Is The Problem
This would never be a problem for an Arch Linux user.
Only if Pamac has been added to the system and has AUR enabled, then it becomes a problem.
- Anyone can adopt an orphan PKGBUILD
- A malicious actor can then modify the PKGBUILD to include malware.
If the PKGBUILD is an upstream PKGBUILD which has been removed from the repo and a malicious actor adopts it and attach malware then a user of the Pamac package manager may inadvertently consume the PKGBUILD as part of ongoing maintenance.
The recent AUR incidents shows that having AUR enabled in the Manjaro Package Manager (Add/Remove Software app) may cause unattended installation of malware.
To our current knowledge, it has not happened - yet, but it is a real danger to be aware of.
A recent example is the libgdata package, which has caused one member to ask how to prevent it from entering the system.
What You Can Do
The advise: Only enable AUR when you need it. Disable after use.
It is necessary to maintain your system on a regular basis.
Keep your system tidy
pamac remove --orphans --unneeded
Regularly consolidate your foreign packages
pamac list --foreign
This will make you aware of packages no longer in the official repositories; it will work for both Manjaro Linux and Arch Linux repositories.
Evaluate the list, and remove as required.
Familiarise yourself with best practise on system maintenance either here in the forum or the Manjaro Wiki page on System Maintenance
The topic on how to maintain Basic System Security may also be of interest.