A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru.
AUR is a community-maintained, widely-used package index for Arch Linux and derivative distributions that hosts package build scripts (PKGBUILDs) for third-party and proprietary tools, beta, or older package versions that are no longer available via the official Linux distribution channels.
The repository has recently become a target of malicious campaigns, including an attack in June in which 400 packages distributed credential-stealing malware with rootkit capabilities. Another campaign in July prompted Arch to temporarily disable package adoption.
The latest campaign was detected on October 13 and involved malicious packages uploaded by a user named “marchos1as” under typosquatted names mimicking the yay and paru command-line tools.
Also known as AUR helpers, these tools simplify software management on Arch Linux by streamlining the retrieval and installation of user-contributed packages.
A thread on the Arch Linux mailing list named “hundreds of aur packages were mass uploaded with malware” alerted users of the malicious uploads.
In minutes, community members confirmed that the packages contained legitimate upstream code combined with a malicious installation script that executed a remote shell script with root privileges.
“The package presents itself as a straightforward repackaging of the legitimate ‘yay’ AUR helper (same upstream URL, same source tarball), but the package name ‘yyay’ and the malicious install scriptlet reveal it is a trojanised impersonation designed to blend in with the real package,” AUR maintainer Andreas Reichel warned.
Another maintainer, Emiliano Gandini Outeda, listed some malicious packages that triggered an alert on his system using rules in his open-source application security tool, TrustSight.
The AUR team banned the account belonging to marchos1as and removed the malicious packages from the repository.
Reichel says that the payload delivered this way was fetched through a Wayback Machine URL that pointed to a personal repository (hellscripter/install-scripts) hosted on the Russian hosting service GitFlic.
Potential links to npm worm
A recent report from application security company SafeDep documented an npm campaign dubbed “DirtyBlanket” that fetched code from a ‘hellscripter/install-scripts’ repository on Codeberg.
The researchers found a Linux worm that deployed the CHAOS remote-access trojan disguised as a font service, which also injected a loader into AUR packages.
Furthermore, an OSV advisory on the “DirtyBlanket” activity describes the same Wayback Machine and GitFlic domain.
Despite the connections, there is currently no confirmation that the two operations are related.
Arch users who downloaded the suspicious packages should assume that their systems were compromised and take immediate remediation action.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
