Fake Arch Linux packages push malware with root privileges
Typosquatted Arch User Repository packages impersonating yay and paru ran a remote shell as root.
On October 13, user marchos1as uploaded typosquatted Arch User Repository packages impersonating the yay and paru AUR helpers. Maintainers found legitimate upstream code paired with an install script that fetched and ran a remote shell as root via a Wayback Machine URL pointing to a GitFlic repository. Arch banned the account and deleted the packages. SafeDep's DirtyBlanket npm reporting references the same repository pattern and the CHAOS remote-access trojan, but no link is confirmed. Users who installed the packages should treat systems as compromised.
74