A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru, which many Arch Linux users run to fetch and build community packages. BleepingComputer reports the campaign was detected on October 13 and used typosquatted names uploaded by an account called “marchos1as.” Members of the Arch community confirmed on the AUR mailing list that the packages held legitimate upstream code plus a malicious install script that ran a remote shell script with root privileges. AUR maintainer Andreas Reichel described one of them, named “yyay,” as “a trojanised impersonation designed to blend in with the real package.”
The AUR team banned the account and removed the packages. According to Reichel, the payload was fetched through a Wayback Machine URL that pointed to a personal repository (hellscripter/install-scripts) on the Russian hosting service GitFlic. A recent SafeDep report on an npm campaign called “DirtyBlanket” fetched code from a repository of the same name on Codeberg, and an OSV advisory describes the same Wayback Machine and GitFlic domain. There is currently no confirmation that the two operations are related. This is the latest in a run of AUR attacks, after a June campaign that spread credential-stealing malware through 400 packages and a July one that led Arch to temporarily disable package adoption; see our July 31 report.
How to check if you’re affected
Affected products are Arch Linux and derivative systems where someone installed an AUR package from the “marchos1as” account, or a package named like “yyay” that mimics yay or paru. The reporting does not list every malicious package name, so check by uploader and by name rather than from a fixed list.
- Run
pacman -Qmto list every installed package that did not come from the official repositories, and look for look-alike names of yay or paru. Compare any suspicious entry against its AUR page and the maintainer name. - If you installed one, BleepingComputer says to assume the system is compromised and remediate immediately. Because the script ran as root, the cautious route is a clean reinstall and rotating credentials and keys that were on the machine, rather than only removing the package.
- Read the
PKGBUILDand any.installscript before building an AUR package, and be wary of ones that download and run remote scripts. Get yay and paru from their official upstream projects. - The maintainer’s TrustSight tool, linked below, flagged some of these packages by rule.