After fake yay packages hit the AUR, DHH asks if Omarchy should drop it
Omarchy already avoids the AUR for installs, and DHH is now floating removing it as an out-of-the-box option.
Image: Omarchy (omarchy.org)
DHH is asking whether Omarchy should stop offering the Arch User Repository (AUR) by default. In a post on X on October 15, 2026, he wrote: “maybe it’s even time to drop offering AUR as an option out of the box? Our own package repository can just expand to capture whatever most people need.”
He was quoting a report from International Cyber Digest, which said an account had uploaded “at least 15 fake copies of yay,” the popular AUR helper, with malware in their install scripts. According to that report, a scan of one of them showed it pulling code from a Russian git host and running it as root.
DHH also reminded users that “Omarchy doesn’t use AUR for install or any of its recommended options. We moved off all that a long time ago.”
For now, this is a question and not a decision. At the time of writing, there is no pull request in the Omarchy repo to remove the AUR option.
If you do use the AUR on your Omarchy machine, the usual advice applies: read each package’s build script before you install it, and be wary of names that look almost like popular tools.
