Malicious Packages Impersonating yay and paru Found in Arch User Repository

Malicious Packages Discovered in AUR

On October 13, a threat actor using the name “marchos1as” uploaded malicious packages to the Arch User Repository (AUR). These packages used typosquatted names to impersonate the widely used AUR helper tools, yay and paru. AUR is a community-maintained package index for Arch Linux, hosting build scripts for third-party software.

Root Privilege Execution

Community members quickly identified that the packages contained legitimate upstream code combined with a malicious installation script. This script executed a remote shell script with root privileges, posing a significant security risk to users who installed them. An AUR maintainer, Andreas Reichel, confirmed the trojanized nature of packages like 'yyay', which mimicked the legitimate 'yay' helper.

Immediate Response and Removal

Upon detection, the Arch Linux community and AUR team responded by banning the “marchos1as” account and removing all malicious packages from the repository. The payload delivered by these packages was fetched via a Wayback Machine URL pointing to a personal repository on GitFlic, a Russian hosting service.

Context of Ongoing Attacks

This incident is part of a series of malicious campaigns targeting the AUR. In June, 400 packages distributed credential-stealing malware with rootkit capabilities, and another campaign in July led Arch to temporarily disable package adoption. These events underscore the challenges of securing community-maintained software repositories against persistent threats.

Potential Links to Other Campaigns

There are potential links between this attack and a recent npm campaign called "DirtyBlanket," documented by SafeDep. That campaign also fetched code from a 'hellscripter/install-scripts' repository, though on Codeberg, and deployed a Linux worm that utilized the CHAOS remote-access tool.