Fake Arch Linux AUR packages exploit typos to run malware with root privileges
Typosquatted Arch Linux AUR packages impersonating yay and paru could run downloaded code as root.
Arch Linux AUR maintainers removed packages uploaded by account marchos1as that typosquatted helpers such as yay and paru. Package yyay looked like a repackaging of legitimate yay but ran a downloaded script as root at install time; a scanner flagged it as malicious with 99% confidence. Maintainer DeepChirp banned the account and deleted the packages less than an hour after the report. The article does not confirm that any user was compromised.
- Account marchos1as uploaded typosquatted AUR packages, including yyay, impersonating yay.
- Install scriptlets downloaded and ran code from gitflic.ru as root during pacman install.
- AUR maintainers banned the account and deleted the packages within about an hour.
- A June AUR campaign was estimated to have touched about 1,500 packages.
Full article465 words · extracted from helpnetsecurity.com · click to collapse
Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine.
AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted build scripts for proprietary programs, beta builds and older software versions that the official repositories do not carry.
Yay and paru, known as AUR helpers, search the AUR for software and then build, install and update it on the user’s machine.
On Tuesday, user James Smith warned the aur-general mailing list that an account named marchos1as had “typo squated popular packages eg yay/paru.”
The subject line of Smith’s message claimed that hundreds of packages had been mass uploaded with malware.
Andreas Reichel, who maintains packages on the AUR, ran one of the packages, named “yyay,” through a malware scanner and shared the results in the mailing list thread. The scanner flagged it as malicious with 99% confidence and blocked the build.
“The package presents itself as a straightforward repackaging of the legitimate ‘yay’ AUR helper (same upstream URL, same source tarball), but the package name ‘yyay’ and the malicious install scriptlet reveal it is a trojanised impersonation designed to blend in with the real package,” Reichel wrote.
“The scriptlet runs arbitrary downloaded code as root on the live system at pacman install/upgrade time. Whatever ‘linux.sh’ currently serves — credential theft, backdoor installation, rootkit deployment — executes with full root privileges on the installing machine,” he added.
The attacker left the usual install functions empty so the file would look harmless at a glance, and placed the malicious command outside them. Reichel described the trick as “a structural deception aimed at casual reviewers and automated scanners.”
The downloaded script came from a personal project on the code hosting site gitflic.ru.
Less than an hour after Smith’s report, another AUR maintainer, DeepChirp, replied that a check had confirmed malicious payloads in the installation scripts of the packages. “I have banned the user and deleted all of their packages,” DeepChirp noted.
In a follow-up message, Reichel said that some of the best developers he knows are from Russia, but that he would block Russian domains “for the time being.”
Months of trouble for the AUR
In June, attackers took over abandoned AUR packages and changed their build instructions to install a malicious npm package with credential-stealing and hiding capabilities, in a campaign that researchers estimated may have affected around 1,500 packages.
In late July, another wave of malware led Arch to suspend package adoption, and days later the project stopped all uploads to the AUR.
Arch Linux was also among the distributions affected by Dirty Frag, a pair of Linux kernel vulnerabilities disclosed in May that let local attackers gain root access.