Attackers uploaded fake Arch Linux packages to the Arch User Repository (AUR) that pretended to be the popular yay and paru package helpers and could compromise systems during installation. The trojanized packages used typosquatted names such as 'yyay', bundled legitimate upstream code with a malicious install script, and fetched a remote shell script with root privileges from infrastructure linked in part to the 'hellscripter/install-scripts' repository on GitFlic via Wayback Machine URLs. The packages were uploaded by the user 'marchos1as' on October 13 and were removed after community reporting.
Why it matters: Arch users who installed the fake packages should treat the affected machines as fully compromised because the malicious code ran with administrator-level access. Users should verify whether they installed the typosquatted AUR packages, rebuild or thoroughly remediate impacted systems, and avoid blindly trusting similarly named community packages.
Bill Toulas
2026.10.15
100% relevant
This article establishes a distinct new AUR supply-chain event focused on fake yay/paru helper packages uploaded in October 2026, separate from the earlier 400-package AUR hijack story already tracked.
← Back to all stories