Based on information from Bleeping Computer, a threat actor uploaded malicious packages to the Arch User Repository (AUR), impersonating popular Arch Linux helper tools like yay and paru.
The malicious packages were uploaded by a user named "marchos1as" and used typosquatted names to mimic the legitimate "yay" and "paru" tools. These AUR helpers simplify software management for Arch Linux users. The compromised packages contained legitimate upstream code combined with a malicious installation script that executed a remote shell script with root privileges. The payload was fetched from a Wayback Machine URL pointing to a personal repository on the Russian hosting service GitFlic. This campaign shows similarities to the "DirtyBlanket" npm campaign, which also used a "hellscripter/install-scripts" repository and a Wayback Machine URL. While connections are being investigated, there is no confirmation of a link. The AUR team has banned the malicious account and removed the packages. Users who downloaded the suspicious packages are advised to assume their systems are compromised and take immediate remediation steps.
Source: Bleeping Computer
