---
title: Arch AUR: typosquatted yay and paru helper packages ran a remote script as root on install | ctxsec
url: https://ctxsec.com/items/aur-yay-paru-typosquat-2026-10
description: ""
status: "confirmed (Arch aur-general + maintainers)"
published: 2026-10-15
---

> 

[← Cybersecurity News](/news) · [markdown](/items/aur-yay-paru-typosquat-2026-10.md)

confirmed (Arch aur-general + maintainers)

2026-10-15

### Arch AUR: typosquatted yay and paru helper packages ran a remote script as root on install

On Oct 13-14 an AUR account named `marchos1as` uploaded lookalike packages for the popular AUR helpers yay and paru (for example `yyay`). They bundled the real upstream source and checksums, but added an install scriptlet whose top-level code, outside the decoy empty functions, piped a remote `linux.sh` into a shell as root on every install and upgrade. The script was fetched through an unpinned Wayback Machine URL pointing at a `hellscripter/install-scripts` repo on GitFlic. The AUR team banned the account and removed the packages. BleepingComputer notes the same repo name appeared in SafeDep's "DirtyBlanket" npm campaign, which is not yet a confirmed link. If any lookalike was installed, treat the host as compromised and rebuild it.

Sources: [aur-general thread](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/L3TGW6CC6WCX32VKEXLFAYDWCQXA2ICZ/) · [BleepingComputer](https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/)