Arch users: Verify yay and paru sources after trojanized AUR packages granted attackers root access

Arch Linux users who installed software from the Arch User Repository are the primary targets of this campaign. Those who may have downloaded packages impersonating the popular helper tools yay or paru could have inadvertently granted a threat actor full root access to their computers. This means an attacker could potentially steal credentials, install backdoors or deploy rootkits on the affected systems without the user’s knowledge.

What packages were involved?

The campaign focused on typosquatted versions of two widely used AUR helpers: yay and paru. These tools simplify software management by retrieving and installing user-contributed packages. The attacker uploaded malicious packages under names that closely resembled the legitimate tools, such as yyay. According to Help Net Security, users who mistyped the package names during installation may have pulled in these fake versions instead of the authentic software.

How did the malware operate?

The malicious packages contained legitimate upstream code combined with a harmful installation script. AUR maintainer Andreas Reichel noted that the package yyay used the same source tarball and upstream URL as the real yay helper to appear authentic. However, the install scriptlet downloaded and executed a remote shell script with root privileges. This allowed arbitrary code to run on the live system during the installation or upgrade process, bypassing normal security checks.

Who discovered and stopped the attack?

Community members detected the threat on October 13. User James Smith alerted the aur-general mailing list, claiming hundreds of packages were mass-uploaded with malware. Maintainer Andreas Reichel confirmed the package was a trojanised impersonation designed to blend in with real packages. Another maintainer, DeepChirp, verified the malicious payloads and stated that the user account marchos1as was banned and all associated packages were deleted from the repository within an hour of the report.

Where did the malicious code come from?

The payload delivered by the fake packages was fetched through a Wayback Machine URL. This link pointed to a personal repository hosted on the Russian hosting service GitFlic. According to BleepingComputer, the repository was named hellscripter/install-scripts. A separate report from SafeDep linked this same repository name to a previous npm campaign called DirtyBlanket, which fetched code from a Codeberg-hosted version of the same project.

What affected people can do

If you use Arch Linux or its derivatives, you should review your installed packages for any unfamiliar names that resemble popular tools. Check your system logs for unusual activity or unexpected network connections that occurred around the time of package installations. Look for signs of credential theft or new administrative accounts. Be wary of follow-up emails or messages claiming to help remove the malware, as these are often scams designed to steal more data. Verify all communications through official channels only.

What to do and how to stay safe: Arch Linux

• Verify the exact spelling and source of any AUR helper packages before installing them, ensuring they match the official upstream repositories.
• Monitor your system for unauthorised changes, such as new user accounts or modified system files, which could indicate a root-level compromise.
• Change passwords for all critical accounts on affected machines, especially those used for email, banking or cloud services, to prevent credential theft.
• Once the vendor provides an update or further guidance, apply it immediately to ensure any residual malicious scripts are removed or neutralised.

Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the attacker successfully steal data from users?

The source material does not confirm whether data was successfully stolen, but notes the malware executed with root privileges, allowing for potential credential theft or backdoor installation.

Are the fake packages still available on the AUR?

No, the AUR team banned the user account marchos1as and removed all the malicious packages from the repository after the community reported them.

What is the difference between yay and yyay?

Yay is the legitimate AUR helper tool, while yyay was the typosquatted, malicious package uploaded by the attacker to impersonate the real software and execute harmful scripts.