Fake Arch Linux packages push malware with root privileges
Malicious Arch Linux packages impersonating popular tools delivered malware with root privileges.
Run yay?
Get an email when a reviewed story names yay, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A threat actor uploaded malicious packages to the Arch User Repository (AUR), impersonating popular Arch Linux helper tools 'yay' and 'paru'. These packages contained legitimate code alongside a malicious script that executed a remote shell script with root privileges. The AUR team has since banned the associated account and removed the malicious packages.
The lesson from this incident
Full lessonA threat actor exploited the open, community-driven nature of the Arch User Repository (AUR) by uploading trojanized versions of popular tools 'yay' and 'paru', embedding a malicious remote shell script alongside legitimate code to evade casual inspection. Because AUR packages are user-submitted and not officially vetted, they represent a significant supply chain risk — especially when users run build helpers with elevated or root privileges. This attack highlights how trust in a community ecosystem can be weaponized against users who assume popular package names are inherently safe. The incident underscores the critical need for source verification and privilege minimization when installing software from third-party repositories.
What helps against this
How we list vendors- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
- url — https://web.archive.org/*
- url — https://gitflic.ru/hellscripter/install-scripts
- malware — CHAOS remote-access trojan