Fake Arch Linux AUR packages exploit typos to run malware with root privileges
Typosquatted Arch Linux AUR packages impersonating yay and paru could run downloaded code as root.
Arch Linux AUR maintainers removed packages uploaded by account marchos1as that typosquatted helpers such as yay and paru. Package yyay looked like a repackaging of legitimate yay but ran a downloaded script as root at install time; a scanner flagged it as malicious with 99% confidence. Maintainer DeepChirp banned the account and deleted the packages less than an hour after the report. The article does not confirm that any user was compromised.
62