The **Arch User Repository (AUR)**, a vital community-maintained package index for **Arch Linux** and its derivatives, has once again been targeted by malicious actors. In the latest incident, detected on October 13, a threat actor uploaded trojanized packages impersonating two widely used AUR helper tools: `yay` and `paru`. These helpers simplify software management by streamlining the retrieval and installation of user-contributed packages. However, the malicious versions, uploaded by a user named “marchos1as” under typosquatted names like `yyay`, contained a hidden danger.  ### Root Privileges Granted The malicious packages were quickly identified following an alert on the **Arch Linux** mailing list. Community members confirmed that while the packages contained legitimate upstream code, they also included a nefarious installation script. This script was designed to execute a remote shell script with root privileges upon installation. **AUR** maintainer **Andreas Reichel** warned, “The package presents itself as a straightforward repackaging of the legitimate 'yay' AUR helper (same upstream URL, same source tarball), but the package name 'yyay' and the malicious install scriptlet reveal it is a trojanised impersonation designed to blend in with the real package.” Another maintainer, **Emiliano Gandini Outeda**, used his open-source application security tool, **TrustSight**, to identify several malicious packages that triggered system alerts. ### Swift Response and Potential Connections The **AUR** team acted promptly, banning the “marchos1as” account and removing the malicious packages from the repository. **Reichel** noted that the payload was fetched via a **Wayback Machine** URL pointing to a personal repository (`hellscripter/install-scripts`) hosted on the Russian service **GitFlic**. This incident bears a striking resemblance to a recent **npm** campaign dubbed “DirtyBlanket,” documented by application security company **SafeDep**. The “DirtyBlanket” campaign involved a Linux worm that deployed the **CHAOS remote-access trojan** and also fetched code from a `hellscripter/install-scripts` repository, albeit on **Codeberg**. An **OSV advisory** on “DirtyBlanket” further describes the same **Wayback Machine** and **GitFlic** domain connections. While the connections are strong, there is no official confirmation yet that these two operations are directly related. ### User Action Recommended **Arch Linux** users who downloaded any suspicious packages should immediately assume their systems are compromised. Remediation steps, including a full system audit and potential reinstallation, are strongly advised.