Friday 16 October 2026
Morning Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Fake Arch Linux packages impersonating yay and paru removed from AUR after malware upload

Campaign used typosquatted names to push trojanised packages that ran remote scripts with root privileges; researchers see links to an npm worm

By LineZotpaper
Published
Read Time2 min
A threat actor uploaded malicious packages to the Arch User Repository (AUR) impersonating the popular helper tools yay and paru, prompting the AUR team to ban the account and remove the packages. The trojanised builds carried a legitimate upstream source combined with an install script that executed a remote shell script with root privileges.

The attack was detected on 13 October and involved packages uploaded by a user named "marchos1as" under typosquatted names mimicking yay and paru, the command-line tools that simplify installation of user-contributed packages on Arch Linux and derivative distributions.

A message on the Arch Linux mailing list, titled "hundreds of aur packages were mass uploaded with malware", alerted the community. Within minutes, members confirmed the packages combined legitimate upstream code with a malicious installation script that fetched and ran a remote shell script with full system privileges.

AUR maintainer Andreas Reichel warned that one package presented itself as a straightforward repackaging of the legitimate yay helper, with the same upstream URL and source tarball, but the package name "yyay" and the malicious install scriptlet revealed a trojanised impersonation designed to blend in with the real package. A second maintainer, Emiliano Gandini Outeda, listed malicious packages flagged by rules in his open-source application security tool, TrustSight.

The AUR team banned the marchos1as account and removed the malicious packages. According to Reichel, the payload was fetched through a Wayback Machine URL pointing to a personal repository (hellscripter/install-scripts) hosted on the Russian service GitFlic.

Researchers at application security firm SafeDep have documented a separate npm campaign, dubbed "DirtyBlanket", that fetched code from a hellscripter/install-scripts repository on Codeberg. That campaign deployed a Linux worm carrying the CHAOS remote-access trojan disguised as a font service, and also injected a loader into AUR packages. An OSV advisory on the DirtyBlanket activity describes the same Wayback Machine and GitFlic infrastructure, suggesting possible overlap between the two campaigns.

The AUR has become an increasingly frequent target. A June attack compromised around 400 packages to distribute credential-stealing malware with rootkit capabilities, and a July campaign prompted Arch to temporarily disable package adoption in an effort to stop the flow of malicious uploads.

§

Analysis

Why This Matters

  • Arch Linux users rely on AUR for thousands of third-party packages, and the repository is widely regarded as a standard tool for the distribution and its derivatives.
  • The malware executed with root privileges, meaning a successful install could give attackers full control of the system, including access to credentials and other sensitive data.
  • This is the third notable AUR attack in recent months, and the apparent connection to an npm campaign points to a wider, cross-ecosystem supply chain effort.

Background

The AUR is a community-maintained package index where users submit PKGBUILD build scripts for packages not available through official Arch Linux channels. Unlike the official repositories, AUR packages are not centrally vetted, and the trust model depends on community review and the reputation of uploaders.

The project has already been forced to respond to this pattern of abuse. A campaign in June compromised around 400 packages with rootkit and credential-stealing malware, and a July wave of malicious uploads led Arch to temporarily disable the ability to adopt orphaned packages. The October incident follows the same playbook: typosquatted package names, repackaged legitimate code, and a hidden payload staged on external infrastructure.

Key Perspectives

AUR maintainers: The team acted quickly to ban the offending account and remove the malicious packages, and maintainer Andreas Reichel publicly detailed how the trojanised build was designed to look authentic while running a malicious install script. Security researchers: SafeDep documents a parallel campaign on npm, the "DirtyBlanket" worm that abuses the same hellscripter/install-scripts repository and the same Wayback Machine and GitFlic staging domains. Researchers see this as evidence of a broader supply chain operation rather than an isolated AUR incident. Users and skeptics: The recurring incidents underscore the risk of trusting community package indexes. Some users are calling for stronger verification practices, such as the rule-based scanning tools that maintainer Emiliano Gandini Outeda demonstrated with TrustSight.

What to Watch

  • Whether the same infrastructure (hellscripter/install-scripts, Wayback Machine URLs, GitFlic hosting) appears in other package ecosystems, including PyPI and Debian.
  • Any further disclosures from SafeDep or the Open Source Vulnerability database clarifying how widely DirtyBlanket and the AUR loader have spread.
  • Whether Arch maintainers introduce permanent safeguards, such as stricter upload checks or restrictions on package adoption, beyond the temporary measures used after the July wave.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe