Fake yay and paru Packages Hit Arch Linux AUR
Counterfeit AUR Helpers Run Code as Root
Researchers found fake Arch Linux packages that pose as the popular tools yay and paru. During installation, they run malicious code with root privileges. The attackers kept the genuine program components and added dangerous commands, so users would not notice the swap.
How the Campaign Unfolded
The campaign surfaced on October 13 in the Arch User Repository (AUR). This community catalog serves Arch Linux and its derivatives. Unlike the official repositories, the AUR lets members publish their own build scripts.
An attacker using the handle marchos1as mass-published programs with names close to well-known utilities.
Lures Built Around yay and paru
The main bait was yay and paru, two helpers that simplify installing AUR software. For example, the fake package yyay nearly duplicated the real yay.
AUR maintainer Andreas Reichel found that the attacker kept the original project address and source archive. However, the attacker added a malicious install script.
Root Access Through a Remote Script
At install time, the extra script downloaded a remote shell script and ran it as root. That gave outside code the highest system privileges.
The attackers delivered the payload through a Wayback Machine link. It led to the hellscripter/install-scripts repository on GitFlic, a Russian platform.
Detection and Cleanup
Members of the Arch Linux community spotted the suspicious packages. Developer Emiliano Gandini Outeda also detected the threat with his own tool, TrustSight.
AUR administrators then blocked the marchos1as account and removed the malicious packages. The number of affected users remains unknown.
Echoes of the DirtyBlanket Campaign
The infrastructure resembles the DirtyBlanket campaign, which SafeDep investigated earlier. In September, nine fake npm packages spread a Linux worm.
That malware installed the CHAOS trojan disguised as a system font service. It used SSH keys to jump to other machines, and it planted a loader in AUR packages.
Shared Traces, Different Hosts
Both campaigns involve hellscripter/install-scripts and the Wayback Machine. Even so, the hosting differs. In the DirtyBlanket case, the code sat on Codeberg, while the new attack used GitFlic.
Researchers have not confirmed that one group runs both operations. Therefore, it is premature to credit the fake packages with every capability of the worm.
A Troubled Record for the AUR
The AUR has faced security problems before. In June, attackers infected hundreds of packages to spread an infostealer with rootkit features. In July, developers temporarily limited the handover of abandoned packages to new maintainers because of mass takeovers.
A similar impersonation tactic previously spread the CHAOS RAT.
What Users Should Do
Anyone who installed a suspicious package should treat the system as compromised. Change credentials and reinstall the operating system from a trusted image.
Before installing from the AUR, check the exact package name and the maintainer. Also read the PKGBUILD and every install script.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
