Arch Linux users who mistyped a package helper name while installing from the Arch User Repository may have handed a stranger root access. The campaign targeted the AUR helpers yay and paru with lookalike packages.
On Tuesday, a user named James Smith warned the aur-general mailing list that an account called marchos1as had typosquatted popular packages. The subject line claimed hundreds of packages had been mass-uploaded with malware.
How the trojan hid
Maintainer Andreas Reichel ran one package, named yyay, through a malware scanner. The build script looked benign at a glance because the usual install functions were left empty – the malicious command sat outside them, a structural deception aimed at casual reviewers and automated scanners.
The scriptlet downloaded a payload called linux.sh from a personal project on the code-hosting site gitflic.ru and executed it as root at install time. Whatever that script served – credential theft, a backdoor, a rootkit – ran with full privileges.
Less than an hour after the report, maintainer DeepChirp confirmed the malicious payloads and banned the account, deleting every package it had published.
The pattern keeps repeating
This is the second AUR abuse wave this year. In June, attackers took over abandoned packages and rewrote their build instructions to pull a credential-stealing npm package, a campaign estimated to touch around 1,500 packages.
Build scripts are code. Read them before you run them, and prefer the official repositories where a package exists.
