Malicious Arch Linux AUR Packages Exploit Typos to Gain Root Access

• •Malicious packages impersonated yay and paru, exploiting typos to gain root access.
• •The AUR team quickly banned the malicious account and removed the harmful packages.
• •Users who installed the affected packages should assume their systems are compromised.

A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated popular tools yay and paru. The attack involved typosquatted package names, such as 'yyay', which contained legitimate code combined with a malicious installation script that executed a remote shell script with root privileges. The malicious packages were detected on October 13, 2026, following a warning from user James Smith on the AUR mailing list. The AUR team banned the account 'marchos1as' and removed the malicious packages shortly after confirmation of the threat. Users who downloaded these packages should assume their systems were compromised. This incident follows previous attacks in June and July that also targeted the AUR with malware. The malicious payloads were fetched from a repository hosted on GitFlic, and while there are potential links to a recent npm campaign, no direct connection has been confirmed.