Arch User Repository: typosquatted copies of the yay and paru AUR helpers (such as 'yyay') ran a remote script as root on install; AUR team banned uploader marchos1as and removed the packages; payload host matches the 'DirtyBlanket' npm worm repository
Arch Linux community members raised the alarm on the aur-general mailing list on 13 October 2026, in a thread titled 'hundreds of aur packages were mass uploaded with malware'. A user named marchos1as had uploaded packages to the Arch User Repository (AUR) under typosquatted names of yay and paru, the two most popular AUR helper tools. The AUR is the community-run index of build scripts (PKGBUILDs) used on Arch Linux and Arch-based distributions. AUR maintainer Andreas Reichel's analysis of one package, 'yyay', found it reused the legitimate yay upstream URL and source tarball but shipped a malicious install scriptlet. Outside any function, so it ran unconditionally as root on every install and upgrade, the scriptlet piped a script fetched through an unpinned Wayback Machine URL into a shell. That URL pointed to a personal repository, hellscripter/install-scripts, on the Russian code host GitFlic. The post_install and post_upgrade functions were emptied to look harmless. Maintainer Emiliano Gandini Outeda flagged further packages with his open-source TrustSight scanner. The AUR team banned the account and removed the packages. The exact number of malicious uploads has not been published. BleepingComputer notes a possible link to the 'DirtyBlanket' npm campaign documented by SafeDep. OSV advisory MAL-2026-17242 says nine npm packages published on 29 September (including express-javascript) fetched a second stage from a hellscripter/install-scripts repository on Codeberg via the Wayback Machine. On Linux that stage runs linux.sh, a worm that installs a Go binary as a 'Font Rendering Service' systemd service (systemd-fontd) proxied over Tor, collects SSH private keys and known_hosts, and spreads to known hosts over SSH. BleepingComputer says the worm deployed the CHAOS RAT and injected a loader into AUR packages, but there is no confirmation the two operations are related. The AUR was also hit in June (about 400 packages carrying credential-stealing malware with rootkit features) and July, when Arch temporarily disabled package adoption. Primary: aur-general mailing list; wire: BleepingComputer (15 Oct).
- Product
- Arch User Repository (AUR) packages impersonating the yay and paru AUR helpers (for example 'yyay')
- Versions
- n/a — malicious packages uploaded by AUR user marchos1as (reported 13 Oct 2026; account banned, packages removed)
- Exploited in Australia?
- unknown
- Patch to
- If you installed 'yyay' or any other look-alike of yay or paru recently, treat the machine as compromised: rebuild it from known-good media and rotate SSH keys, tokens and passwords used on it. As a precaution, look for a systemd-fontd / 'Font Rendering Service' unit and unexpected Tor traffic (seen in the related npm worm). Read PKGBUILD and .install files before every build, install AUR helpers only by their exact names, and keep AUR builds off servers and privileged admin workstations.
Primary: aur-general (Arch Linux) — Re: hundreds of aur packages were mass uploaded with malware (13–14 Oct 2026) · Vendor: OSV — MAL-2026-17242: malicious express-javascript (npm) / DirtyBlanket hellscripter payload · BleepingComputer — Fake Arch Linux packages push malware with root privileges (15 Oct 2026)