Fake Arch Linux packages push malware with root privileges
BLUF
Fake yay/paru AUR packages can give attackers administrative control over Arch Linux machines.
NEWS
A threat actor uploaded malicious packages to the Arch User Repository that masquerade as the widely used AUR helpers yay and paru. The fake packages could execute malicious code during installation, potentially escalating privileges and persisting on affected systems.
Why I Care
Arch Linux users who install or update these helpers from untrusted AUR sources may expose their systems to remote control, credential theft, and full administrative compromise.
Next Steps
Arch users should immediately verify installed yay/paru package provenance, remove suspicious packages, rebuild from official or trusted sources, and review sudo logs; administrators should block known malicious package names in internal repositories and notify users within 24 hours.
Source: BleepingComputer ·