GoKawiilMalicious AUR packages impersonate yay and paru Arch Linux helper tools
A threat actor using the account 'marchos1as' uploaded trojanized packages to the Arch User Repository, typosquatting the popular yay and paru helper tools. The packages bundled legitimate upstream code with a malicious install script that ran a remote shell script with root privileges, discovered by the community on October 13. Arch Linux maintainers banned the account and removed the malicious uploads after users flagged them on the project's mailing list.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident is the latest in a string of attacks on AUR, following a June campaign that hit roughly 400 packages with credential-stealing rootkit malware and a July incident that forced Arch to suspend package adoption, suggesting attackers increasingly see community repositories as an easy distribution channel. Because AUR relies on user trust and manual review rather than centralized vetting, typosquatting attacks that grant root access could spread quickly before detection, underscoring the risks of unvetted software supply chains for Linux users.
- Fake 'yyay' and similar packages impersonated the legitimate yay and paru AUR helpers.
- Malicious install scripts executed remote shell code with root privileges on infected systems.
- Arch Linux banned the uploader's account and removed the packages after community detection on October 13.
Source: bleepingcomputer.com, 2026-10-15
Published there as: “Fake Arch Linux packages push malware with root privileges”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.