Fake Arch Linux AUR packages ran code as root

On October 13, marchos1as uploaded typosquatted Arch AUR packages that could run downloaded code as root; maintainers removed them.

On October 13, Arch User Repository account marchos1as uploaded typosquatted packages impersonating the yay and paru AUR helpers, including yyay, which repackaged legitimate upstream code. Install scripts downloaded and ran remote code as root; BleepingComputer says the fetch used a Wayback Machine URL pointing to a GitFlic repository, while Help Net Security says scriptlets pulled code from gitflic.ru. A scanner flagged yyay as malicious with 99% confidence. Help Net Security reports that maintainer DeepChirp banned the account and deleted the packages less than an hour after the report; BleepingComputer also reports the ban and removal but gives no timing. BleepingComputer says users who installed the packages should treat systems as compromised, whereas Help Net Security does not confirm any compromise. A possible tie to SafeDep’s DirtyBlanket npm reporting and the CHAOS remote-access trojan remains unconfirmed, and Help Net Security separately notes a June AUR campaign estimated at about 1,500 packages.

• On October 13, Arch User Repository account marchos1as uploaded typosquatted packages impersonating the yay and paru helpers, including a package named yyay.
• Install scripts executed downloaded code as root during pacman install; BleepingComputer says a Wayback Machine URL pointed at a GitFlic repository, while Help Net Security says scriptlets fetched code from gitflic.ru.
• A scanner flagged yyay as malicious with 99% confidence.
• AUR maintainer DeepChirp banned the account and deleted the packages less than an hour after the report, according to Help Net Security.
• BleepingComputer advises anyone who installed the packages to treat systems as compromised; Help Net Security does not confirm that any user was compromised.
• A link between this incident and SafeDep’s DirtyBlanket npm reporting or the CHAOS remote-access trojan is unconfirmed.
• Help Net Security separately cites a June AUR campaign estimated to have touched about 1,500 packages.