Trojanized Arch AUR Packages Ran Malware with Root Privileges
Summary
Malicious AUR packages impersonating the yay and paru helpers ran a remote shell script with root privileges. The AUR team banned the uploader and removed the packages; links to a separate npm campaign remain unconfirmed.
Key points
- Malicious packages uploaded under typosquatted names impersonated the popular Arch Linux helpers yay and paru.
- The packages combined legitimate upstream code with an install script that fetched and executed a remote shell script as root.
- The activity was detected on October 13, 2026, after an alert on the Arch Linux mailing list.
- The AUR team banned the uploader, “marchos1as,” and removed the malicious packages.
- The payload was reportedly fetched via a Wayback Machine URL pointing to a personal repository hosted on GitFlic.
- Researchers noted similarities to the DirtyBlanket npm campaign, but a connection between the operations has not been confirmed.
- Arch users who installed the suspicious packages were advised to assume their systems were compromised and take remediation action.
Article Details
- Event Type
- Malicious package supply-chain campaign targeting the Arch User Repository (AUR)
- Impact
- Trojanized packages impersonating yay and paru included a malicious installation script that ran a remote shell script with root privileges. Users who installed the packages may have compromised systems; the AUR team banned the uploader's account and removed the packages.
MITRE ATT&CK
People
Andreas ReichelAUR maintainer who warned that a trojanized package impersonated the legitimate yay helper.Emiliano Gandini OutedaMaintainer who listed malicious packages that triggered alerts from TrustSight.Mikko HyppönenNamed speaker in an unrelated promotional announcement included in the article.
Malware
Products
Arch LinuxFake Arch Linux packages push malware with root privilegesArch User Repository (AUR)A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru.paruA threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru.TrustSightAnother maintainer, Emiliano Gandini Outeda, listed some malicious packages that triggered an alert on his system using rules in his open-source application security tool, TrustSight.yayA threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru.