---
title: Hunt: trojanised AUR helpers (yyay and paru lookalikes) on Arch desktops and build hosts | ctxsec
url: https://ctxsec.com/items/hunt-aur-yyay-gitflic
description: ""
status: "hunt idea"
published: 2026-10-16
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-aur-yyay-gitflic.md)

hunt idea

2026-10-16

### Hunt: trojanised AUR helpers (yyay and paru lookalikes) on Arch desktops and build hosts

From the aur-general analysis. (1) Package inventory: `pacman -Qm` for foreign packages whose names are near-misses of yay/paru, or whose packager is `marchos1as`. (2) Install-time network: look in proxy or DNS logs for requests to `web.archive.org` wrapping `gitflic.ru` URLs, or to `gitflic.ru/project/hellscripter`, around package install times in `/var/log/pacman.log`. (3) Scriptlet review: grep cached PKGBUILD `.install` files for top-level `curl`/`wget` piped to `sh`/`bash` outside function bodies. (4) Any hit means root code ran: rebuild the machine and rotate credentials stored on it.

Sources: [aur-general thread](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/L3TGW6CC6WCX32VKEXLFAYDWCQXA2ICZ/) · [BleepingComputer](https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/)