Arch Linux developers faced a new supply-chain attack on October 13, 2026, when malicious packages impersonating two of the most popular AUR helper tools — yay and paru — were discovered in the Arch User Repository. Uploaded under the account "marchos1as", the packages bundled legitimate upstream code with a trojanized .install scriptlet that fetched and executed a remote shell script with root privileges. The payload deployed Tor, installed a modified version of the CHAOS RAT remote access tool disguised as a fake systemd font service, harvested SSH private keys, injected malicious commands into AUR packages that those keys could push to, and republished npm packages with malicious preinstall hooks. The account was banned and the packages removed within minutes, but any system that installed the fake packages should be treated as fully compromised.
The Arch User Repository is the community-maintained package repository for Arch Linux, where packages are contributed by volunteers and explicitly not vetted by the project. The Arch wiki warns that AUR packages have not been fully validated and users should manually review every PKGBUILD before compiling. This trust architecture, designed to give the community flexibility, is exactly the weakness exploited by threat actors. In the previous campaign dubbed "Atomic Arch" and discovered in June 2026, over 1,500 orphaned packages were compromised, distributing a Rust credential stealer paired with an eBPF rootkit. In July, Arch Linux was forced to temporarily disable package adoption to contain the flood. The October campaign followed the same logic but employed different vectors: instead of adopting abandoned packages, attackers created counterfeit packages that directly impersonated the names of the most installed helpers. Community members confirmed the malicious content within minutes of upload via the aur-general mailing list, where threads titled "hundreds of aur packages were mass uploaded with malware" alerted users of the trojanized scriptlets.
This attack illustrates a structural vulnerability affecting not just Arch Linux but the entire open-source ecosystem built around community repositories: the boundary between legitimate contributions and malware is virtually nonexistent when installation executes arbitrary scripts with elevated privileges. The install scripts of the fake packages executed as root because pacman/makepkg runs with automatic elevation. This means any line injected into the .install scriptlet has direct access to the operating system, the filesystem, and user-sensitive data. The observed propagation chain — Tor for C2 communication, CHAOS RAT as backdoor, known_hosts scanning for lateral movement, AUR package poisoning through spoofed commits, and npm republishing with preinstall hooks — constitutes a supply-chain worm that uses the developer's own workstation environment as the attack vector. This pattern mirrors earlier supply-chain intrusions, notably the DirtyBlanket campaign from September 2026, which similarly weaponized preinstall hooks to deliver a self-spreading worm across npm and AUR ecosystems. AUR maintainer Andreas Reichel documented how the "yyay" package presented itself as a straightforward repackaging of the legitimate yay tool while its typosquatted name and malicious install scriptlet revealed it as a trojanized impersonation designed to blend in.
Arch Linux users and derivative distributions should immediately inspect their pacman installation history for yyay or any paru variant installed between October 13 and 15, 2026. All AUR package .install scripts should be reviewed for curl|bash or wget|bash patterns. Detection of fake systemd font services, outbound Tor traffic, and suspicious commits on AUR packages are critical indicators. All SSH keys, .npmrc tokens, passwords, and session credentials should be rotated. Systems that installed the packages should be considered fully compromised and, if possible, reinstalled from trusted media.
Sources: BleepingComputer, BleepingComputer, BleepingComputer, Arch Linux
✓ Independent sources cross-checked and verified before publishing
