Fake Arch Linux AUR Packages Impersonate yay and paru Helpers, Execute Malware as Root
Threat actors have uploaded malicious packages to the Arch User Repository (AUR) that impersonate two popular Arch Linux helper tools, yay and paru.
The malicious AUR package included legitimate upstream code alongside an installation script that executed a remote shell script with root privileges, potentially giving attackers full control of affected systems.
Malicious AUR package impersonated yay and paru
The AUR is a community-maintained package index widely used by Arch Linux and derivative distributions. It hosts package build scripts, known as PKGBUILDs, for third-party and proprietary tools, beta releases, and older software versions that are no longer available through official distribution channels.
The repository has recently been targeted by multiple malicious campaigns, including a June attack involving 400 packages that distributed credential-stealing malware with rootkit capabilities. Another campaign in July caused Arch to temporarily halt adoption of the affected package.
The latest campaign was detected on October 13 and involved a malicious package uploaded by a user named marchos1as. The package used the typosquatting name yyay, designed to resemble the popular yay and paru command-line tools.
Also known as AUR helpers, yay and paru simplify software management on Arch Linux by streamlining the acquisition and installation of user-provided packages.
A thread on the Arch Linux mailing list titled “Hundreds of aur packages were mass uploaded with malware” warned users about the malicious upload.
Within minutes, community members confirmed that the package contained legitimate upstream code combined with a malicious installation scriptlet that executed a remote shell script with root privileges.
“Although this package appears to be a simple repackaging of the legitimate ‘yay’ AUR helper (same upstream URL, same source tarball), the package name ‘yyay’ and the malicious installation scriptlet indicate that it is a Trojanized impersonation designed to blend with the real package,” AUR maintainer Andreas Reichel warned.
Another maintainer, Emiliano Gandini Auteda, listed several malicious packages that use the rules of the open-source application security tool TrustSight to trigger alerts on affected systems.
The AUR team banned the account belonging to marchos1as and removed the malicious package from the repository.
According to Reichel, the payload delivered through the package was obtained using a Wayback Machine URL pointing to a personal repository named hellscripter/install-scripts, hosted on the Russian service GitFlic.
Potential link to the DirtyBlanket npm worm
Recent reports from application security companies have linked an npm campaign called “DirtyBlanket” to code from Codeberg’s hellscripter/install-scripts repository. SafeDep documented the npm campaign.
Researchers discovered a Linux worm that deploys the CHAOS remote access Trojan while disguising itself as a font service. The worm also injects a loader into AUR packages.
Moreover, an OSV advisory describing the “DirtyBlanket” activity references the same Wayback Machine and GitFlic domains.
Although the incidents share infrastructure and other similarities, there is currently no proof that the two operations are related.
What Arch Linux users should do
Arch Linux users who downloaded suspicious AUR packages should assume that their systems may have been compromised and take immediate remedial action.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, correct, and revalidate at machine speed.
Source: www.bleepingcomputer.com