Fake Arch Linux packages push malware with root privileges
-
A threat actor has uploaded malicious packages to the Arch User Repository (AUR) that impersonate two widely used AUR helper tools, yay and paru. Users who installed these fake packages risked running malware with root privileges, since AUR helpers are typically invoked with elevated permissions during package installation and updates.
The affected package names reported are:
- yay (malicious impersonation published to the AUR)
- paru (malicious impersonation published to the AUR)
AUR is a community-driven repository where anyone can submit build scripts, so packages are not vetted the way official Arch Linux repositories are. Attackers abused this trust model by publishing look-alike entries for the legitimate yay and paru projects, hoping users would install them without checking the maintainer, package history, or PKGBUILD contents.
Because these helpers operate with root privileges, malicious code in a PKGBUILD can execute system-level commands during the build or install process. That makes the impact potentially severe, ranging from data theft to full system compromise.
Recommended precautions for Arch users:
- Verify the maintainer, vote count, and package history before installing anything from the AUR.
- Inspect the PKGBUILD and any accompanying scripts before building.
- Prefer the official repositories for tools like yay and paru where possible.
- Remove any suspicious AUR packages you may have installed and audit your system for unexpected changes.
Source: BleepingComputer
Have you ever audited a PKGBUILD before installing from the AUR, or do you trust the helper tools to handle it for you?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login