GoKawiilMalicious AUR packages impersonate yay and paru Arch Linux helper tools
A threat actor using the account 'marchos1as' uploaded trojanized packages to the Arch User Repository, typosquatting the popular yay and paru helper tools. The packages bundled legitimate upstream code with a malicious install script that ran a remote shell script with root privileges, discovered by the community on October 13. Arch Linux maintainers banned the account and removed the malicious uploads after users flagged them on the project's mailing list.