# Ownership Transfer Is the Soft Point in Package Distribution ## Claim Changing who controls a published package is a trust transfer that reaches every existing installation, so it needs review at least as strict as initial publication. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds wherever an update channel pushes to already-installed systems and maintainership can change hands — package repositories, plugin and extension directories, container registries. - Breaks where installations pin to a specific publisher key rather than a package name, since the transfer then cannot silently inherit trust. - Weakens where abandonment is common enough that strict transfer review would strand large numbers of packages — that tension is real and unresolved in the source, not a design detail to wave away. ## Evidence The Arch User Repository's second malware campaign in 2026 (following an earlier one that infected 1,500+ packages) reached at least 200 packages primarily through package adoption: anyone could claim maintainership of an orphaned package and push a malicious update to everyone who already had it installed. The host reports "there were apparently no real controls around that." Arch's response — disabling new adoptions — treats the symptom; the gap is that maintainer transfer was never treated as a security-relevant event in the first place. ## Links - [[3. Resources/Permanent Notes/A Defense Experts Fail Is Not a Defense for Users]] — because extends: that note covers why user review can't catch what experts miss; this one covers the upstream event (ownership change) that made review necessary in the first place. - [[3. Resources/Permanent Notes/Update Signatures Prove Provenance Not Freshness]] — because contrasts: a valid signature proves the package came from a signer, not that the signer is still the party you trusted — the same gap a silent ownership transfer exploits. - [[3. Resources/MOCs/Open Source Governance MOC]] — because applies-in: ownership-transfer review is governance infrastructure for any community-run distribution channel, WordPress plugin directories included. ## Tests / falsifiers - Compare malicious-update incident rates between repositories that require identity/review on maintainer transfer and those that treat it as administrative, controlling for repository size and package count. - If a repository with strict transfer review still suffers adoption-vector compromises at a comparable rate, the claim is false — the control isn't doing the work attributed to it. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/Arch Under Attack, Framework Laptop 13 Pro Looks Good for Linux, GoG on Linux - Linux Weekly News]] — reports the AUR adoption vector and the absence of transfer controls.