Fake Arch Linux packages push malware with root privileges

A threat actor uploaded malicious packages to the Arch User Repository (AUR) under the username 'marchos1as', impersonating popular AUR helper tools 'yay' and 'paru' using typosquatted names like 'yyay'. These packages contained legitimate source code combined with a malicious install script that executed a remote shell script with root privileges. The payload was fetched via a Wayback Machine URL pointing to a GitFlic-hosted repository 'hellscripter/install-scripts'. Potential connections exist to the 'DirtyBlanket' npm campaign involving the same infrastructure, though no definitive link has been confirmed. Arch Linux maintainers removed the packages and banned the account.

AI-extracted · verify before operational use