Fake Arch Linux packages delivered root-level malware

The Arch User Repository (AUR) has once again become a staging ground for a malware campaign. On October 13, packages uploaded under the account "marchos1as" were found masquerading as two popular tools, yay and paru.

AUR is a community-maintained package index for Arch Linux and its derivatives. It hosts build scripts (PKGBUILDs) for third-party and proprietary software, as well as beta and older releases no longer available through official channels. Known as AUR helpers, yay and paru streamline the retrieval and installation of user-contributed packages.

Legitimate code plus a malicious script

The alarm was raised by a thread on the Arch Linux mailing list, tellingly titled "hundreds of aur packages were mass uploaded with malware." Within minutes, community members confirmed that the packages contained genuine upstream code alongside a malicious install script that executed a remote shell script with root privileges.

"The package presents itself as a straightforward repackaging of the legitimate 'yay' AUR helper — same upstream URL, same source tarball — but the package name 'yyay' and the malicious install scriptlet reveal it is a trojanised impersonation designed to blend in with the real package," warned AUR maintainer Andreas Reichel. Another maintainer, Emiliano Gandini Outeda, listed some of the malicious packages that triggered alerts on his system via rules in his open-source tool TrustSight.

The AUR team banned the marchos1as account and pulled the packages. According to Reichel, the payload was fetched through a Wayback Machine URL pointing to a personal repository (hellscripter/install-scripts) hosted on the Russian service GitFlic.

A possible npm worm connection

A recent report from SafeDep documented an npm campaign dubbed "DirtyBlanket" that fetched code from a hellscripter/install-scripts repository on Codeberg. The researchers found a Linux worm deploying the CHAOS remote-access trojan disguised as a font service, which also injected a loader into AUR packages. An OSV advisory on the same activity cites the same Wayback Machine URL and GitFlic domain.

Despite these overlaps, there is currently no confirmation that the two operations are linked.

This is not the first attack on AUR this year: in June, 400 packages were found distributing credential-stealing malware with rootkit capabilities, and in July Arch temporarily disabled package adoption. Users who downloaded the suspicious packages are advised to assume their systems were compromised and take immediate remediation action.

Source: Bleeping Computer