Malicious AUR Packages Impersonating yay and paru Removed
AUR maintainers banned the uploader and pulled packages that ran a remote shell script with root privileges after detection on October 13, 2026.
Malicious packages impersonating the yay and paru AUR helpers were uploaded to the Arch User Repository and detected on October 13, 2026, according to bleepingcomputer.com. The uploads came from a user named marchos1as, who published them under typosquatted names.
A thread on the Arch Linux mailing list titled "hundreds of aur packages were mass uploaded with malware" alerted users to the uploads. Community members confirmed the packages contained legitimate upstream code plus a malicious installation script that executed a remote shell script with root privileges.
The AUR team banned the marchos1as account and deleted the malicious packages. AUR maintainer Andreas Reichel said the payload was fetched through a Wayback Machine URL pointing to the repository hellscripter/install-scripts on GitFlic.
Earlier incidents had already put the repository's review process under scrutiny. In June, 400 packages distributed credential-stealing malware with rootkit capabilities, and in July another campaign prompted Arch to temporarily disable package adoption.
Quick answers
What did the malicious AUR packages do?
They bundled legitimate upstream code with an installation script that ran a remote shell script with root privileges.
What action did AUR take?
The AUR team banned the marchos1as account and removed the malicious packages.
When were the packages detected?
They were detected on October 13, 2026.