[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBpJePYJPZhbzdrlsz4TRtu869dL3LyDiYI7EKIQ55Pk":3},{"article":4,"iocs":56,"watch_terms":67,"solutions":68,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"b4fdbd38-0180-4dac-aa33-d5db1cf1cba1","Fake Arch Linux packages push malware with root privileges","fake-arch-linux-packages-push-malware-with-root-privileges-bf40b1","A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]","A threat actor uploaded malicious packages to the Arch User Repository (AUR), impersonating popular Arch Linux helper tools 'yay' and 'paru'. These packages contained legitimate code alongside a malicious script that executed a remote shell script with root privileges. The AUR team has since banned the associated account and removed the malicious packages.","Malicious Arch Linux packages impersonating popular tools delivered malware with root privileges.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffake-arch-linux-packages-push-malware-with-root-privileges\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F07\u002F18\u002Farch-linux-white.jpg","2026-10-15T17:12:31+00:00","2026-10-15T18:00:09.411857+00:00",8,[17,20,22,25,27,30],{"name":18,"type":19},"yay","product",{"name":21,"type":19},"paru",{"name":23,"type":24},"Arch User Repository","technology",{"name":26,"type":24},"Linux",{"name":28,"type":29},"marchos1as","threat_actor",{"name":31,"type":32},"DirtyBlanket","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,64],{"type":58,"value":59,"context":60},"url","https:\u002F\u002Fweb.archive.org\u002F*","URL used to fetch the malicious payload",{"type":58,"value":62,"context":63},"https:\u002F\u002Fgitflic.ru\u002Fhellscripter\u002Finstall-scripts","Personal repository hosted on Russian service GitFlic, linked to payload delivery",{"type":37,"value":65,"context":66},"CHAOS remote-access trojan","Malware potentially deployed by the npm campaign with links to this AUR attack",[18,21],{"controls":69,"vendors":151},[70,98,125],{"slug":55,"name":71,"problem":72,"products":73},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":99,"name":100,"problem":101,"products":102},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[103,110,117],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":99,"product_name":107,"url":108,"description":109},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":114,"url":115,"description":116},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"slug":126,"name":127,"problem":128,"products":129},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":147,"product_name":148,"url":149,"description":150},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":166},"malicious-aur-packages-execute-root-level-malware-via-typosquatting","Malicious AUR Packages Execute Root-Level Malware via Typosquatting","A threat actor exploited the open, community-driven nature of the Arch User Repository (AUR) by uploading trojanized versions of popular tools 'yay' and 'paru', embedding a malicious remote shell script alongside legitimate code to evade casual inspection. Because AUR packages are user-submitted and not officially vetted, they represent a significant supply chain risk — especially when users run build helpers with elevated or root privileges. This attack highlights how trust in a community ecosystem can be weaponized against users who assume popular package names are inherently safe. The incident underscores the critical need for source verification and privilege minimization when installing software from third-party repositories.",[157,158,159,160,161,162,163,164,165],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AC-6: Least Privilege","NIST CSF ID.SC-4: Supply Chain Risk Assessment","SLSA Framework: Supply-chain Levels for Software Artifacts",{}]