Lookalike yay and paru packages on the AUR ran a remote script as root
AUR user marchos1as uploaded typosquatted yay and paru packages whose install script ran a remote shell script as root, detected October 13. It is the third AUR malware campaign BleepingComputer lists, after June and July.
The Watch · Security desk
What happened
- Community members confirmed within minutes that the packages combined legitimate upstream code with an install script that executed a remote shell script as root.
- The AUR team banned the marchos1as account and removed the malicious packages from the repository.
- Maintainer Andreas Reichel says the payload came through a Wayback Machine URL that pointed to a personal GitFlic repository named hellscripter/install-scripts.
- SafeDep's report on an npm campaign called DirtyBlanket describes code fetched from a repository with the same name, hellscripter/install-scripts, on Codeberg.
Why it matters
- What it costs cost Any host that installed one of the packages needs incident response, because BleepingComputer says users who downloaded them should assume compromise and remediate immediately.
- What it limits constraint The shell script was fetched from a Wayback Machine URL, so the package files show a download step and the malware itself sits outside them.
- Who's exposed exposure Yay and paru streamline retrieval and installation of user-contributed packages, so a convincing copy is a plausible thing for an Arch user to install.
Andreas Reichel, an AUR maintainer, described what separates these packages from the real helper. "The package presents itself as a straightforward repackaging of the legitimate 'yay' AUR helper (same upstream URL, same source tarball), but the package name 'yyay' and the malicious install scriptlet reveal it is a trojanised impersonation designed to blend in with the real package," he warned [4]. The upstream URL and tarball match the real project, so the package name and the install scriptlet are where we think a reader's attention belongs before building any AUR package.
Detection ran through the community. A mailing list thread titled "hundreds of aur packages were mass uploaded with malware" alerted users [5]. Maintainer Emiliano Gandini Outeda listed packages that triggered alerts on his system under rules in TrustSight, his open-source application security tool [6]. BleepingComputer did not report how many packages or installs this campaign involved.
The repository has been hit before. In June, 400 packages distributed credential-stealing malware with rootkit capabilities [8]. A July campaign led Arch to temporarily disable package adoption [9]. Add the October 13 detection and the report names three campaigns [13]. The October packages go after yay and paru, the helpers Arch users run to retrieve and install user-contributed packages [12].
The infrastructure trail runs into a second operation. SafeDep's DirtyBlanket report describes a Linux worm that deployed the CHAOS remote-access trojan disguised as a font service and injected a loader into AUR packages [15]. An OSV advisory on the same activity describes the same Wayback Machine and GitFlic domain [16]. BleepingComputer says there is currently no confirmation that the two operations are related [17].
What to watch
- Whether SafeDep, OSV or the Arch team publish evidence tying marchos1as to the DirtyBlanket npm operation.
- Whether the AUR team changes upload or review controls, as it did when it disabled package adoption in July.
- Whether new lookalike helper packages appear under other accounts after the marchos1as ban.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A threat actor uploaded malicious packages to the Arch User Repository that impersonated two popular helper tools, yay and paru.
- [2]
The latest campaign was detected on October 13 and involved malicious packages uploaded by a user named marchos1as under typosquatted names mimicking the yay and paru command-line tools.
- [3]
Community members confirmed within minutes that the packages contained legitimate upstream code combined with a malicious installation script that executed a remote shell script with root privileges.
- [4]
"The package presents itself as a straightforward repackaging of the legitimate 'yay' AUR helper (same upstream URL, same source tarball), but the package name 'yyay' and the malicious install scriptlet reveal it is a trojanised impersonation designed to blend in with the real package," AUR maintainer Andreas Reichel warned.
- [5]
A thread on the Arch Linux mailing list named "hundreds of aur packages were mass uploaded with malware" alerted users of the malicious uploads.
- [6]
Maintainer Emiliano Gandini Outeda listed some malicious packages that triggered an alert on his system using rules in his open-source application security tool, TrustSight.
- [7]
The AUR team banned the account belonging to marchos1as and removed the malicious packages from the repository.
- [8]
In June, 400 AUR packages distributed credential-stealing malware with rootkit capabilities.
- [9]
Another AUR campaign in July prompted Arch to temporarily disable package adoption.
- [10]
Reichel says the payload delivered this way was fetched through a Wayback Machine URL that pointed to a personal repository (hellscripter/install-scripts) hosted on the Russian hosting service GitFlic.
- [11]
Arch users who downloaded the suspicious packages should assume that their systems were compromised and take immediate remediation action.
- [12]
AUR helpers such as yay and paru simplify software management on Arch Linux by streamlining the retrieval and installation of user-contributed packages.
- [13]
The October 13 detection is the third AUR malware campaign named in the report, after the June and July campaigns.
- [14]
A report from application security company SafeDep documented an npm campaign dubbed DirtyBlanket that fetched code from a hellscripter/install-scripts repository on Codeberg.
- [15]
SafeDep's researchers found a Linux worm that deployed the CHAOS remote-access trojan disguised as a font service, which also injected a loader into AUR packages.
- [16]
An OSV advisory on the DirtyBlanket activity describes the same Wayback Machine and GitFlic domain.
- [17]
There is currently no confirmation that the DirtyBlanket operation and the AUR operation are related.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- bleepingcomputer.comFake Arch Linux packages push malware with root privileges
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Software Supply Chain SecurityFollow
- Package repository malwareFollow
- Linux securityFollow
Entities
- Arch User RepositoryFollow
- Arch LinuxFollow
- yayFollow
- paruFollow
- SafeDepFollow
- TrustSightFollow
- BleepingComputerFollow