# Fake AUR helper packages (yyay, paru lookalikes) deliver malware via trojanized install scripts with root privileges

> Malicious Arch User Repository packages impersonating the AUR helpers yay and paru combined legitimate upstream code with a trojanized install scriptlet that ran a remote shell script with root privileges. The uploader account marchos1as was banned and the packages removed; users who installed them should assume compromise.

- **Published:** 2026-10-15T17:24:35Z
- **Last reviewed:** 2026-10-15T17:24:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3646
- **ID:** TL-2026-3646
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-13 the Arch Linux community identified malicious AUR packages named 'yyay' (a typosquat of the yay helper) and a 'paru' lookalike, uploaded by the account 'marchos1as'. Per BleepingComputer, the packages bundled legitimate upstream helper code together with a malicious installation script (.install scriptlet) that fetched and executed a remote shell script. Because AUR packages are installed through pacman/makepkg, the scriptlet executes as root at install time, giving the payload immediate full-system privileges. The payload was staged through a Wayback Machine URL pointing at a personal repository, 'hellscripter/install-scripts', hosted on GitFlic (a Russian Git hosting service). Community members confirmed the malicious content within minutes of upload; the AUR team banned marchos1as and removed the packages.

BleepingComputer ties the incident to the CHAOS remote-access trojan and to the npm 'DirtyBlanket' campaign documented by SafeDep (published 2026-09-29). SafeDep's analysis shows that DirtyBlanket packages used a preinstall hook to pull a Node.js loader from the Wayback Machine copy of codeberg.org/hellscripter/install-scripts, which then ran linux.sh from the same repository. linux.sh installs Tor, drops a Go-based CHAOS client (github.com/tiagorlampert/CHAOS/client) disguised as a 'Font Rendering Service' (systemd-fontrenderd / systemd-fontd / systemd-fontcached) with a Tor hidden-service C2, harvests SSH private keys and .npmrc tokens, spreads over SSH to hosts in known_hosts, appends 'bash <(curl ...)' to the .install scripts of AUR packages the stolen keys can push to (spoofing the maintainer as git author), and republishes npm packages with a malicious preinstall hook. The shared repository name 'hellscripter/install-scripts' and the Wayback/Codeberg delivery pattern overlap with the yyay/paru incident, but the source articles do not confirm that the yyay/paru payload is the identical DirtyBlanket worm or that the actors are the same; the exact payload of the yyay/paru scriptlet is not published in the available sources. Treat the DirtyBlanket artifacts below as related hunting leads, not confirmed payload indicators for yyay/paru.

No CVEs are involved; this is a software supply-chain / user-repository abuse case. Defenders should review pacman/AUR install history for yyay and the unofficial paru package, inspect .install scriptlets for curl|bash patterns, and hunt for the fake systemd font services, outbound Tor traffic and Wayback/GitFlic/Codeberg fetches by package-build processes. Any host that installed the packages should be treated as fully compromised, with SSH keys, npm tokens and AUR credentials rotated.

## MITRE ATT&CK

- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1543.002 Systemd Service
- T1036.005 Match Legitimate Resource Name or Location
- T1222.002 Linux and Mac Permissions
- T1552.004 Private Keys
- T1021.004 SSH
- T1113 Screen Capture
- T1090.003 Multi-hop Proxy
- T1071.001 Web Protocols

## Sources

- [Fake Arch Linux packages push malware with root privileges](https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/)
- [DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm (SafeDep)](https://safedep.io/dirtyblanket-express-impersonation-npm/)
- [ossf/malicious-packages PR #1579: SafeDep credit and worm details for dirtyblanket npm reports](https://github.com/ossf/malicious-packages/pull/1579)
- [ossf/malicious-packages PR #1565: OSV reports for dirtyblanket Express lookalike worm](https://github.com/ossf/malicious-packages/pull/1565)
- [CachyOS Forum: NPM supply chain attack targeting AUR packages](https://discuss.cachyos.org/t/aur-npm-supply-chain-attack-targeting-aur-packages/36428)
- [TrustSight - open-source tool to identify suspicious packages](https://github.com/emiliano-go/trustsight)
- [aurscan - PKGBUILD/.install scanner for yay and paru](https://github.com/manticore-projects/aurscan)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3646