Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine.

Arch Linux malware

AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted build scripts for proprietary programs, beta builds and older software versions that the official repositories do not carry.

Yay and paru, known as AUR helpers, search the AUR for software and then build, install and update it on the user’s machine.

On Tuesday, user James Smith warned the aur-general mailing list that an account named marchos1as had “typo squated popular packages eg yay/paru.”

The subject line of Smith’s message claimed that hundreds of packages had been mass uploaded with malware.

Andreas Reichel, who maintains packages on the AUR, ran one of the packages, named “yyay,” through a malware scanner and shared the results in the mailing list thread. The scanner flagged it as malicious with 99% confidence and blocked the build.

“The package presents itself as a straightforward repackaging of the legitimate ‘yay’ AUR helper (same upstream URL, same source tarball), but the package name ‘yyay’ and the malicious install scriptlet reveal it is a trojanised impersonation designed to blend in with the real package,” Reichel wrote.

“The scriptlet runs arbitrary downloaded code as root on the live system at pacman install/upgrade time. Whatever ‘linux.sh’ currently serves — credential theft, backdoor installation, rootkit deployment — executes with full root privileges on the installing machine,” he added.

The attacker left the usual install functions empty so the file would look harmless at a glance, and placed the malicious command outside them. Reichel described the trick as “a structural deception aimed at casual reviewers and automated scanners.”

The downloaded script came from a personal project on the code hosting site gitflic.ru.

Less than an hour after Smith’s report, another AUR maintainer, DeepChirp, replied that a check had confirmed malicious payloads in the installation scripts of the packages. “I have banned the user and deleted all of their packages,” DeepChirp noted.

In a follow-up message, Reichel said that some of the best developers he knows are from Russia, but that he would block Russian domains “for the time being.”

Months of trouble for the AUR

In June, attackers took over abandoned AUR packages and changed their build instructions to install a malicious npm package with credential-stealing and hiding capabilities, in a campaign that researchers estimated may have affected around 1,500 packages.

In late July, another wave of malware led Arch to suspend package adoption, and days later the project stopped all uploads to the AUR.

Arch Linux was also among the distributions affected by Dirty Frag, a pair of Linux kernel vulnerabilities disclosed in May that let local attackers gain root access.