Malicious Arch Linux AUR packages impersonate yay and paru helpers
Threat actors uploaded trojanized versions of popular Arch Linux package helpers to the community repository, executing remote scripts with root privileges.
Key points
- Malicious packages mimicking yay and paru were uploaded to the Arch User Repository on October 13.
- The trojanized packages contained installation scripts that executed remote shell commands with root privileges.
- The AUR team banned the offending account and removed the malicious packages after community detection.
Threat actors uploaded malicious packages to the Arch User Repository on October 13, impersonating two widely used helper tools known as yay and paru. According to BleepingComputer, these trojanized packages were designed to blend in with legitimate software while delivering malware to unsuspecting users of Arch Linux and its derivatives.
The malicious uploads originated from an account named marchos1as and used typosquatted names to mimic the popular command-line utilities. Community members quickly confirmed that the packages contained legitimate upstream code combined with a malicious installation script. This script executed a remote shell script with root privileges, running code with elevated permissions on the host system.
Context and Background
The Arch User Repository is a community-maintained package index that hosts build scripts for third-party and proprietary tools not available in official distribution channels. It has recently become a frequent target for malicious campaigns. In June, an attack distributed credential-stealing malware with rootkit capabilities across 400 packages. Another campaign in July prompted Arch to temporarily disable package adoption features to mitigate abuse.
AUR maintainer Andreas Reichel warned that the latest package presented itself as a straightforward repackaging of the legitimate yay helper. He noted that while the upstream URL and source tarball matched the real package, the package name yyay and the malicious install scriptlet revealed it as a trojanized impersonation. This technique relies on users overlooking minor naming discrepancies in favor of familiar tool functionality.
Who Is Affected
The packages impersonated AUR helpers, which are tools that simplify software management on Arch Linux by streamlining the retrieval and installation of user-contributed packages. Emiliano Gandini Outeda, another maintainer, listed several malicious packages that triggered alerts on his system using rules in his open-source application security tool, TrustSight.
The payload delivered by these packages was fetched through a Wayback Machine URL pointing to a personal repository hosted on the Russian service GitFlic. A recent report from SafeDep documented a similar npm campaign dubbed DirtyBlanket that fetched code from a hellscripter/install-scripts repository on Codeberg. This suggests a shared infrastructure or methodology among threat actors targeting open-source ecosystems.
What should you do?
The AUR team has banned the marchos1as account and removed the malicious packages from the repository. Security professionals should monitor their Arch Linux environments for unauthorized root-level processes or connections to known malicious repositories. Community alerts via mailing lists remain a primary detection method for these rapid-response threats.
What to do and how to stay safe: Arch Linux
- Verify the integrity of installed AUR packages by comparing their checksums against official upstream sources.
- Monitor system logs for unexpected execution of remote shell scripts or connections to unknown hosting services.
- Review recent package installations for typosquatted names that mimic popular tools like yay or paru.
- Once the vendor provides an update, ensure your package manager is configured to reject packages from banned accounts.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific tools were impersonated in this attack?
The malicious packages impersonated yay and paru, which are popular command-line helper tools for managing Arch Linux packages.
How did the malware gain access to the system?
The packages contained a malicious installation script that executed a remote shell script with root privileges during the installation process.
Has the threat actor been stopped?
The AUR team banned the account marchos1as and removed the malicious packages, but users who installed them may still be compromised.
