Fake Arch Linux packages push malware with root privileges
Typosquatted Arch User Repository packages impersonating yay and paru ran a remote shell as root.
On October 13, user marchos1as uploaded typosquatted Arch User Repository packages impersonating the yay and paru AUR helpers. Maintainers found legitimate upstream code paired with an install script that fetched and ran a remote shell as root via a Wayback Machine URL pointing to a GitFlic repository. Arch banned the account and deleted the packages. SafeDep's DirtyBlanket npm reporting references the same repository pattern and the CHAOS remote-access trojan, but no link is confirmed. Users who installed the packages should treat systems as compromised.
- Account marchos1as uploaded yay and paru typosquats on October 13.
- Install scripts pulled a remote root shell via Wayback Machine and GitFlic.
- AUR banned the account and removed the malicious packages.
- A link to the DirtyBlanket npm worm and CHAOS RAT is unconfirmed.
Full article471 words · extracted from bleepingcomputer.com · click to collapse
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru.
AUR is a community-maintained, widely-used package index for Arch Linux and derivative distributions that hosts package build scripts (PKGBUILDs) for third-party and proprietary tools, beta, or older package versions that are no longer available via the official Linux distribution channels.
The repository has recently become a target of malicious campaigns, including an attack in June in which 400 packages distributed credential-stealing malware with rootkit capabilities. Another campaign in July prompted Arch to temporarily disable package adoption.
The latest campaign was detected on October 13 and involved malicious packages uploaded by a user named “marchos1as” under typosquatted names mimicking the yay and paru command-line tools.
Also known as AUR helpers, these tools simplify software management on Arch Linux by streamlining the retrieval and installation of user-contributed packages.
A thread on the Arch Linux mailing list named "hundreds of aur packages were mass uploaded with malware" alerted users of the malicious uploads.
In minutes, community members confirmed that the packages contained legitimate upstream code combined with a malicious installation script that executed a remote shell script with root privileges.
“The package presents itself as a straightforward repackaging of the legitimate 'yay' AUR helper (same upstream URL, same source tarball), but the package name 'yyay' and the malicious install scriptlet reveal it is a trojanised impersonation designed to blend in with the real package,” AUR maintainer Andreas Reichel warned.
Another maintainer, Emiliano Gandini Outeda, listed some malicious packages that triggered an alert on his system using rules in his open-source application security tool, TrustSight.
The AUR team banned the account belonging to marchos1as and removed the malicious packages from the repository.
Reichel says that the payload delivered this way was fetched through a Wayback Machine URL that pointed to a personal repository (hellscripter/install-scripts) hosted on the Russian hosting service GitFlic.
Potential links to npm worm
A recent report from application security company SafeDep documented an npm campaign dubbed "DirtyBlanket" that fetched code from a ‘hellscripter/install-scripts’ repository on Codeberg.
The researchers found a Linux worm that deployed the CHAOS remote-access trojan disguised as a font service, which also injected a loader into AUR packages.
Furthermore, an OSV advisory on the "DirtyBlanket" activity describes the same Wayback Machine and GitFlic domain.
Despite the connections, there is currently no confirmation that the two operations are related.
Arch users who downloaded the suspicious packages should assume that their systems were compromised and take immediate remediation action.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.