On Oct 13-14 an AUR account named marchos1as uploaded lookalike packages for the popular AUR helpers yay and paru (for example yyay). They bundled the real upstream source and checksums, but added an install scriptlet whose top-level code, outside the decoy empty functions, piped a remote linux.sh into a shell as root on every install and upgrade. The script was fetched through an unpinned Wayback Machine URL pointing at a hellscripter/install-scripts repo on GitFlic. The AUR team banned the account and removed the packages. BleepingComputer notes the same repo name appeared in SafeDep's "DirtyBlanket" npm campaign, which is not yet a confirmed link. If any lookalike was installed, treat the host as compromised and rebuild it.