Cybersecurity
Malicious Arch packages reached AUR
Packages uploaded under names resembling yay and paru were found in the Arch User Repository with an install script that fetched remote code as root, and the AUR team removed them.
- On 13 October, a user named marchos1as uploaded AUR packages that copied the names of yay and paru.
- Community members found that the packages bundled upstream code with an install script that pulled and ran a remote shell script with administrator rights.
- AUR maintainer Andreas Reichel warned that one package copied the legitimate yay source details while using a different name and a malicious scriptlet, and Emiliano Gandini Outeda said TrustSight flagged some of the packages on his system.
- The AUR team banned marchos1as and removed the packages, and Reichel said the payload came through a Wayback Machine link to a repository on GitFlic.
- SafeDep’s DirtyBlanket report and an OSV advisory described similar infrastructure in a separate npm campaign, but the article said there was no confirmation that the cases were linked.
On 13 October, packages using names meant to resemble yay and paru appeared in AUR. They were uploaded by a user called marchos1as.
People in the Arch community checked the packages within minutes and found that they contained code from the real projects plus an install step that fetched a shell command and ran it with root rights. Reichel said one package reused the same upstream location and tarball details as yay while its name and script exposed the impersonation.
Outeda said some of the packages triggered rules in TrustSight, his open-source application security tool. The AUR team then banned the account and removed the uploads.
Reichel said the payload was obtained through a Wayback Machine link that led to a personal repository on GitFlic. SafeDep had separately reported an npm operation called DirtyBlanket, and an OSV advisory described the same Wayback Machine and GitFlic domain, but the article said the two incidents were not confirmed as related.
The article told Arch users who had installed the packages to treat their systems as compromised and carry out remediation.
Named in this story
People
- marchos1as
- the account that uploaded the malicious packages
- Andreas Reichel
- the AUR maintainer who warned about the package
- Emiliano Gandini Outeda
- the maintainer who saw alerts in TrustSight
Companies
- GitFlic
- the hosting service that held the repository linked to the payload
- SafeDep
- the company that reported the DirtyBlanket campaign
Organisations
- AUR team
- the group that banned the account and removed the uploads
Products and systems
- Arch User Repository (AUR)
- the package index targeted by the uploads
- Arch Linux
- the distribution whose helper tools were imitated
- yay
- one helper tool impersonated by the fake package
- paru
- one helper tool impersonated by the fake package
- TrustSight
- the open-source tool that flagged some packages
- Wayback Machine
- the source of the URL used for the payload
- DirtyBlanket
- the npm campaign said to resemble the AUR activity
- CHAOS
- the remote-access trojan described in the SafeDep report
How the source tells it
The piece was mostly technical, but it used threat language and an explicit remediation warning to create alarm and urgency.
- alarm the repeated use of malicious and trojanised labels
- urgency the instruction to assume compromise and take immediate remediation action