Malicious packages impersonating the popular yay and paru AUR helpers were detected in the Arch User Repository on October 13. The packages combined legitimate upstream software with an installation script that retrieved and executed additional code as root.
According to BleepingComputer’s October 15, 2026 report, the AUR team removed the packages and banned the uploader account, named marchos1as. The account name identifies the repository user involved, not a known person or threat group.
Legitimate code concealed the malicious installer
AUR maintainer Andreas Reichel described yyay as one example of the typosquatting operation. The package imitated yay and retained the legitimate project’s upstream URL and source archive, making much of its package definition appear authentic.
The malicious component was placed in the installation process. When a user installed the package, its script launched a remotely hosted shell script with root privileges. Reichel said the code was obtained through a Wayback Machine URL associated with the personal repository hellscripter/install-scripts on the Russian hosting service GitFlic.
The observed chain was therefore:
- A user selected a package whose name resembled
yayorparu. - The package installed genuine upstream code alongside a modified installation script.
- That script downloaded and executed remote code as root.
The reporting did not identify the final payload or describe its capabilities. No malware family has been assigned to this AUR campaign.
A warning posted to the Arch Linux mailing list drew community attention to the uploads, with members confirming malicious packages within minutes. Maintainer Emiliano Gandini Outeda also reported that rules from his open-source application security tool, TrustSight, detected some of the packages on his system.
Infrastructure overlap does not establish attribution
The Wayback Machine URL pattern and the repository name hellscripter/install-scripts also appear in reporting about a separate npm operation called DirtyBlanket. SafeDep researchers previously associated that activity with a Linux worm that installed the CHAOS remote-access trojan and modified AUR packages with a loader.
There is no confirmed link between DirtyBlanket and the packages uploaded by marchos1as. The infrastructure details are potential points of overlap, but they do not establish that the same operator controlled both campaigns. The referenced repository was also reported on different hosting platforms: GitFlic in the AUR incident and Codeberg in SafeDep’s analysis of the npm activity.
Users who installed the packages should treat the host as compromised
The AUR team’s removal of the packages prevents further installations from those entries, but it does not reverse code already executed on affected systems. Because the installer ran with root permissions, users who downloaded the suspicious packages are advised to assume that the host was compromised and begin remediation immediately.
The available guidance does not provide package-specific cleanup instructions. With the final payload unidentified, simply uninstalling the typosquatted package cannot establish that any additional code or system changes have been removed.
