"The package presents itself as a straightforward repackaging of the legitimate 'yay' AUR helper (same upstream URL, same source tarball), but the package name 'yyay' and the malicious install scriptlet reveal it is a trojanised impersonation designed to blend in with the real package," warned AUR maintainer Andreas Reichel.
What was uploaded: typosquats of yay and paru
On October 13, a threat actor using the account name "marchos1as" uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular AUR helpers, yay and paru. The uploads used typosquatted package names — such as "yyay" — while reusing legitimate upstream URLs and source tarballs, an approach designed to appear routine to users and package reviewers. A thread on the Arch Linux mailing list titled "hundreds of aur packages were mass uploaded with malware" first alerted the community to the mass uploads.
How the packages delivered malware with root privileges
Community reviewers quickly confirmed a consistent pattern: the packages combined legitimate upstream code with a malicious installation scriptlet. That scriptlet executed a remote shell script with root privileges, fetching a payload through a Wayback Machine URL that pointed to a personal repository identified as hellscripter/install-scripts. According to Andreas Reichel, the repository referenced by the Wayback Machine was hosted on the Russian hosting service GitFlic.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAUR response: account ban and package removal
After community confirmation, the AUR team banned the marchos1as account and removed the malicious packages from the repository. Emiliano Gandini Outeda, another AUR maintainer, listed multiple malicious packages that had triggered alerts on his system using rules in his open-source application security tool, TrustSight, contributing to rapid community detection and reporting.
Connections to the "DirtyBlanket" npm activity — similar infrastructure, not confirmed linkage
Researchers have noted infrastructure overlaps between this AUR campaign and a previously reported npm operation. Application security company SafeDep documented an npm campaign called "DirtyBlanket" that fetched code from a hellscripter/install-scripts repository on Codeberg. SafeDep researchers described a Linux worm that deployed the CHAOS remote-access trojan disguised as a font service and that also injected a loader into AUR packages. An OSV advisory on the DirtyBlanket activity describes use of the same Wayback Machine and GitFlic domain. Despite these similarities in repositories and domains, the sources state there is currently no confirmation that the two operations are related.
Context: this is part of a recent, recurring targeting of AUR
The October 13 uploads follow earlier campaigns against the AUR. In June, an incident involved roughly 400 packages that distributed credential-stealing malware with rootkit capabilities. A separate campaign in July prompted the Arch project to temporarily disable package adoption, reflecting a pattern of repeated attempts to use AUR as a distribution channel for malicious code.
What this means for Arch users, AUR maintainers, and application security researchers
- Arch users: The published guidance is direct — users who downloaded the suspicious packages should assume their systems were compromised and take immediate remediation action.
- AUR maintainers: The community response in this incident — rapid identification on the mailing list, use of tools such as TrustSight to flag malicious packages, and the banning and removal actions by the AUR team — underscores both the effectiveness and the necessity of active review and automated detection rules.
- Application security researchers: The shared use of a hellscripter/install-scripts repository, Wayback Machine fetches, and a GitFlic-hosted repository has drawn investigators' interest; SafeDep and an OSV advisory have documented these elements, but the sources caution that a definitive operational link between npm's DirtyBlanket activity and the AUR uploads has not been established.
The facts in this case are straightforward and unsettling: trojanized packages used familiar upstream artefacts to hide a malicious install script that ran code as root; community detection and tools flagged the anomaly; and the AUR team removed the offending uploads and banned the uploader. The overlap in repository names and hosting domains with the DirtyBlanket research complicates the picture, but investigators have not concluded a direct connection. For now, the clearest and most immediate step for anyone who installed these packages is the one the community has urged — assume compromise and take immediate remediation action.
Source: BleepingComputer — Fake Arch Linux packages push malware with root privileges
