yay (Product): news timeline & CVEs

Fake Arch Linux AUR packages exploit typos to run malware with root privileges

Typosquatted Arch Linux AUR packages impersonating yay and paru could run downloaded code as root.

Arch Linux AUR maintainers removed packages uploaded by account marchos1as that typosquatted helpers such as yay and paru. Package yyay looked like a repackaging of legitimate yay but ran a downloaded script as root at install time; a scanner flagged it as malicious with 99% confidence. Maintainer DeepChirp banned the account and deleted the packages less than an hour after the report. The article does not confirm that any user was compromised.

Help Net SecurityOct 16, 09:58 UTC · 18h agoMalware 2 sources1

Fake Arch Linux packages push malware with root privileges

Typosquatted Arch User Repository packages impersonating yay and paru ran a remote shell as root.

On October 13, user marchos1as uploaded typosquatted Arch User Repository packages impersonating the yay and paru AUR helpers. Maintainers found legitimate upstream code paired with an install script that fetched and ran a remote shell as root via a Wayback Machine URL pointing to a GitFlic repository. Arch banned the account and deleted the packages. SafeDep's DirtyBlanket npm reporting references the same repository pattern and the CHAOS remote-access trojan, but no link is confirmed. Users who installed the packages should treat systems as compromised.

BleepingComputerupdated Oct 16, 09:58 UTC · 18h agofirst Oct 15, 17:12 UTC · 1d agoMalware in the wild 2 sources

yay

Timeline2 articles

Appears with

Fake Arch Linux AUR packages exploit typos to run malware with root privileges

Fake Arch Linux packages push malware with root privileges