Threat reportSupply ChainTL-2026-3646
Fake AUR helper packages (yyay, paru lookalikes) deliver malware via trojanized install scripts with root privileges
Fake AUR helper packages (yyay, paru lookalikes) deliver (TL-2026-3646), also tracked as Fake AUR helper packages, is a high-severity supply-chain compromise, first published 2026-10-15. It has no confirmed attribution, affects Arch Linux Arch User Repository (AUR) packages: yyay and paru, maps to 12 MITRE ATT&CK techniques (T1021.004, T1036.005, T1059.004), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-3646
- Threat ID
- TL-2026-3646
- Also known as
- Fake AUR helper packages, yyay AUR malware
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, open-source
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Fake AUR helper packages (yyay, paru lookalikes) deliver
Malware and tooling: CHAOS RAT, DirtyBlanket, Tor - S0183
How Fake AUR helper packages (yyay, paru lookalikes) deliver works
Malicious Arch User Repository packages impersonating the AUR helpers yay and paru combined legitimate upstream code with a trojanized install scriptlet that ran a remote shell script with root privileges. The uploader account marchos1as was banned and the packages removed; users who installed them should assume compromise.
On 2026-10-13 the Arch Linux community identified malicious AUR packages named 'yyay' (a typosquat of the yay helper) and a 'paru' lookalike, uploaded by the account 'marchos1as'. Per BleepingComputer, the packages bundled legitimate upstream helper code together with a malicious installation script (.install scriptlet) that fetched and executed a remote shell script. Because AUR packages are installed through pacman/makepkg, the scriptlet executes as root at install time, giving the payload immediate full-system privileges. The payload was staged through a Wayback Machine URL pointing at a personal repository, 'hellscripter/install-scripts', hosted on GitFlic (a Russian Git hosting service). Community members confirmed the malicious content within minutes of upload; the AUR team banned marchos1as and removed the packages.
BleepingComputer ties the incident to the CHAOS remote-access trojan and to the npm 'DirtyBlanket' campaign documented by SafeDep (published 2026-09-29). SafeDep's analysis shows that DirtyBlanket packages used a preinstall hook to pull a Node.js loader from the Wayback Machine copy of codeberg.org/hellscripter/install-scripts, which then ran linux.sh from the same repository. linux.sh installs Tor, drops a Go-based CHAOS client (github.com/tiagorlampert/CHAOS/client) disguised as a 'Font Rendering Service' (systemd-fontrenderd / systemd-fontd / systemd-fontcached) with a Tor hidden-service C2, harvests SSH private keys and .npmrc tokens, spreads over SSH to hosts in known_hosts, appends 'bash <(curl ...)' to the .install scripts of AUR packages the stolen keys can push to (spoofing the maintainer as git author), and republishes npm packages with a malicious preinstall hook. The shared repository name 'hellscripter/install-scripts' and the Wayback/Codeberg delivery pattern overlap with the yyay/paru incident, but the source articles do not confirm that the yyay/paru payload is the identical DirtyBlanket worm or that the actors are the same; the exact payload of the yyay/paru scriptlet is not published in the available sources. Treat the DirtyBlanket artifacts below as related hunting leads, not confirmed payload indicators for yyay/paru.
No CVEs are involved; this is a software supply-chain / user-repository abuse case. Defenders should review pacman/AUR install history for yyay and the unofficial paru package, inspect .install scriptlets for curl|bash patterns, and hunt for the fake systemd font services, outbound Tor traffic and Wayback/GitFlic/Codeberg fetches by package-build processes. Any host that installed the packages should be treated as fully compromised, with SSH keys, npm tokens and AUR credentials rotated.
MITRE ATT&CK techniques used in TL-2026-3646
Lateral Movement
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Execution
T1059.004 Unix Shell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090.003 Multi-hop Proxy
Collection
Initial Access
T1195.002 Compromise Software Supply Chain
defense-impairment
T1222.002 Linux and Mac Permissions
Persistence
Credential Access
Resource Development
Affected products and versions in Fake AUR helper packages (yyay, paru lookalikes) deliver
- Arch Linux — Arch User Repository (AUR) packages: yyay and paru lookalike uploaded by marchos1as
Vulnerable versions: Any host that installed the malicious yyay/paru packages
Fixed in: Packages removed and account marchos1as banned by the AUR team; no patch applies
Remediation for Fake AUR helper packages (yyay, paru lookalikes) deliver
Immediate actions
- Check pacman/AUR history (pacman -Qm, /var/log/pacman.log) for yyay or an unofficial 'paru' package built from the marchos1as account and remove it
- Assume compromise of any host that installed the packages: isolate, then rebuild from known-good media rather than cleaning in place
- Rotate SSH private keys, npm tokens (.npmrc), AUR SSH keys and any credentials present on the host
- Hunt for fake systemd font services (systemd-fontrenderd.service, systemd-fontcached.service, /usr/lib/systemd/systemd-fontrenderd) and chattr +i immutable flags on them
- Block or alert on package-build processes fetching from web.archive.org, gitflic.ru and codeberg.org hellscripter/install-scripts
Workarounds
- Build AUR packages in unprivileged containers or chroots and review scriptlets before installing the resulting package
Longer-term hardening
- Always read PKGBUILD and .install scriptlets before building AUR packages; verify package maintainer and age
- Use an AUR scanner that inspects PKGBUILD/.install before makepkg runs (e.g. TrustSight, aurscan)
- Install AUR helpers only from the official sources (pacman -S yay from the official repos or the verified upstream), not from searches
- Restrict outbound Tor and monitor new systemd units on developer and maintainer workstations
Weaknesses (CWE) in Fake AUR helper packages (yyay, paru lookalikes) deliver
Timeline of Fake AUR helper packages (yyay, paru lookalikes) deliver
- npm account 'dirtyblanket' published nine Express/React lookalike packages between 06:05 and 06:38 UTC whose preinstall hook pulls the hellscripter loader and linux.sh worm
- Wayback Machine snapshot 20260929052436 of codeberg.org/hellscripter/install-scripts node.js loader captured, about 40 minutes before the first DirtyBlanket npm package was published (SafeDep)
- ossf/malicious-packages merged SafeDep-enriched DirtyBlanket reports including linux.sh and systemd-fontd hashes
- AUR team banned the marchos1as account and removed the malicious packages
- Malicious AUR packages yyay and a paru lookalike uploaded by marchos1as were detected; community members confirmed malicious install scripts within minutes
- BleepingComputer published 'Fake Arch Linux packages push malware with root privileges', linking the incident to CHAOS RAT and the DirtyBlanket campaign
Sources cited for Fake AUR helper packages (yyay, paru lookalikes) deliver
- Fake Arch Linux packages push malware with root privileges
- DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm (SafeDep)
- ossf/malicious-packages PR #1579: SafeDep credit and worm details for dirtyblanket npm reports
- ossf/malicious-packages PR #1565: OSV reports for dirtyblanket Express lookalike worm
- CachyOS Forum: NPM supply chain attack targeting AUR packages
- TrustSight - open-source tool to identify suspicious packages
- aurscan - PKGBUILD/.install scanner for yay and paru
Detection coverage for TL-2026-3646
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3646 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.