Fake yay and paru packages on Arch's AUR ran remote scripts with root privileges

A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated yay and paru, two of the most widely used AUR helper tools, and executed a remote shell script with root privileges on systems that installed them, BleepingComputer reported on October 15, 2026. The activity was detected on October 13, and the AUR team has since banned the uploading account and removed the packages. Users who installed any of them should assume their systems are compromised.

What happened

The AUR is a community-maintained collection of package build scripts for Arch Linux and derivative distributions, and its contents are not vetted by the distribution's maintainers before publication. According to BleepingComputer, an account named marchos1as uploaded typosquatted packages imitating yay and paru, including one named yyay. An alert posted to the Arch Linux aur-general mailing list, whose thread title referred to hundreds of AUR packages being mass uploaded with malware, prompted community members to examine the packages, and they confirmed the malicious behavior within minutes. The publication did not give an exact count of the malicious packages.

Technical details

BleepingComputer reports that the packages combined genuine upstream code with a malicious install script. During installation, that script ran a remote shell script with root privileges. Maintainer Andreas Reichel said the payload was retrieved through a Wayback Machine URL pointing to a personal repository hosted on GitFlic, a Russian code hosting service. Maintainer Emiliano Gandini Outeda said his open-source tool TrustSight flagged some of the malicious packages.

The publication also noted a possible but unconfirmed connection to an npm campaign that SafeDep documented under the name DirtyBlanket. That campaign fetched code from a similarly named hellscripter/install-scripts repository and, according to SafeDep's researchers, involved a Linux worm that deployed the CHAOS remote access trojan disguised as a font service and injected a loader into AUR packages. An OSV advisory, MAL-2026-17242, references the same Wayback Machine and GitFlic location. BleepingComputer stressed that there is no confirmation the two operations are related.

The incident follows earlier abuse of the repository. BleepingComputer recalled that in June about 400 AUR packages distributed credential-stealing malware with rootkit capabilities, and that in July Arch temporarily disabled package adoption to curb a flood of malicious uploads.

Who is affected

Arch Linux and Arch-based distribution users who installed packages from the AUR around October 13, especially anyone who searched for and installed yay or paru by name rather than from the official upstream sources, may be affected. Because the payload ran as root, an infected system could have been fully taken over.

What to do

• Check installed foreign packages with pacman -Qm and look for misspelled helpers such as yyay or packages whose maintainer was marchos1as.
• If a malicious package was installed, treat the system as compromised: isolate it, preserve evidence, rebuild from a trusted image where possible, and rotate credentials, SSH keys and tokens stored on it.
• Review PKGBUILD and .install files before building any AUR package, and be wary of scripts that download and execute remote content.
• Search for outbound connections to Wayback Machine URLs referencing hellscripter/install-scripts, and consult OSV advisory MAL-2026-17242 for indicators.