AList Ownership-Change Concerns—A June 2025 Community Record
In June 2025, community members raised concerns that ownership or operational control of the AList open-source storage-management project might have changed. They pointed to documentation, download, container, repository, website, and Telegram changes.
This page preserves those reports. A changed maintainer or commercial product is not inherently malicious, and the screenshots alone do not prove a sale or compromise.
Reported signs
The source lists:
- documentation download links changing without a prominent explanation;
- changes in the latest Docker image;
- difficulty contacting the former developer and a change in Telegram group control;
- repository commits containing advertising-related material.
Repository activity
The Chinese article linked the AList repository and included these archived screenshots:
Repository history can show that files changed, but interpreting intent requires authenticated maintainer statements, organization-transfer records, signed releases, and code review.
Desktop commercialization concerns
The source also reported that an AList desktop application appeared to be packaged and sold:
Commercial distribution can be compatible with an open-source license. The relevant questions are license compliance, source and notice obligations, binary provenance, data practices, and whether branding or download changes were disclosed.
Community reports
The source says Telegram participants reported:
- possible ownership change;
- nontechnical WeChat links added to Chinese documentation;
- website and download addresses changing;
- a new Tencent Cloud COS download link later blocked as an “illegal file.”
Those are dated community reports rather than an independent malware finding.
New maintainer response
The source links the discussion: “Was the project sold? The official website is 404 and the docs have changed for two weeks”
Readers should review the full issue history, maintainer responses, current organization, and current release process rather than relying only on the screenshot.
Safe response to an ownership or release change
For a self-hosted tool with storage credentials:
- do not pull a moving
latestimage automatically; - pin the last reviewed image digest or release;
- export configuration and back up data;
- inventory cloud tokens, cookies, mount credentials, and webhook secrets;
- compare source and build changes before updating;
- rotate secrets if an untrusted build ran with access;
- restrict outbound network access where practical;
- monitor release signatures, SBOMs, checksums, and maintainer announcements;
- test a migration or alternative before an emergency.
Switching to another project solely because it is open source does not remove supply-chain risk. Review its maintainers, license, release provenance, update mechanism, and security history.
Conclusion
The June 2025 evidence justified caution and a pause before automatically updating AList. It did not, by itself, prove that a sale occurred or that every new build was malicious.
Dated security record
Project ownership, domains, repositories, and maintainers may have changed again since this article. Verify the current official project and signed release chain before installing or updating.