A threat actor uploaded malicious packages to the Arch User Repository (AUR) that imitated two popular utility tools, yay and paru.
AUR is a community-maintained, widely used package index for Arch Linux and derived distributions that hosts package build scripts (PKGBUILDs) for third-party and proprietary tools, beta versions or older package versions that are no longer available through official Linux distribution channels.
The repository has recently been the target of malicious campaigns, including an attack in June in which 400 packages distributed credential-stealing malware with rootkit capabilities. Another campaign in July caused Arch to temporarily disable package rollout.
The latest campaign was discovered on October 13 and included malicious packages uploaded by a user named “marchos1as” under typosquat names that mimic the yay and paru command-line tools.
These tools, also known as AUR helpers, simplify software management on Arch Linux by streamlining the process of retrieving and installing user-provided packages.
A thread on the Arch Linux mailing list titled “Hundreds of AUR packages uploaded en masse containing malware” alerted users to the malicious uploads.
Within minutes, community members confirmed that the packages contained legitimate upstream code combined with a malicious installation script that executed a remote shell script with root privileges.
“The package presents itself as a simple repackaging of the legitimate ‘yay’ AUR helper (same upstream URL, same source tarball), but the package name ‘yyay’ and the malicious installation scriptlet reveal that it is a Trojanized imitation designed to match the real package.” AUR supervisor Andreas Reichel warned.
Another maintainer, Emiliano Gandini Outeda, listed some malicious packages that triggered an alert on his system using rules in his open source application security tool. TrustSight.
The AUR team has suspended the marchos1as account and removed the malicious packages from the repository.
Reichel says that the payload delivered in this way was obtained via a Wayback Machine URL that pointed to a personal repository (hellscripter/install-scripts) hosted on the Russian hosting service GitFlic.
Possible links to the NPM worm
A recent report from an application security company SafeDep documented an NPM campaign called “DirtyBlanket” that pulled code from a “hellscripter/install-scripts” repository on Codeberg.
The researchers found a Linux worm that deployed the remote access Trojan CHAOS disguised as a font service, which also injected a loader into AUR packages.
In addition, a OSV advice in the activity “DirtyBlanket” describes the same Wayback Machine and GitFlic domain.
Despite the connections, there is currently no confirmation that the two operations are related.
Arch users who downloaded the suspicious packages should assume their systems have been compromised and take immediate remedial action.
