Fake Arch Linux packages impersonating popular software management tools appeared in the Arch User Repository (AUR), triggering a community investigation. The packages combined legitimate code with malicious installation scripts that ran remotely fetched code with root privileges.
The campaign came to light on October 13. Subsequently, the AUR team removed the malicious packages and banned the account responsible, “marchos1as.”
However, removing the listings does not reverse any compromise on machines where users already installed the affected software.
Attackers Copied Popular AUR Helpers
The malicious uploads used names resembling yay and paru, two command-line tools that simplify installing and managing AUR packages.
This approach, known as typosquatting, relies on users mistaking a similar-looking name for a trusted project. One identified package used the name “yyay” to imitate yay.
Moreover, the impersonator referenced the genuine project’s upstream website and source archive. Those legitimate details helped the package appear credible despite its malicious installation component.
AUR operates as a community-maintained collection of build scripts for Arch Linux and compatible distributions. Unlike the distribution’s official repositories, it hosts user-contributed instructions for building third-party software.
Installation Scripts Executed Remote Code as Root
After a warning appeared on the Arch Linux mailing list, community members quickly examined the suspicious uploads.
They found genuine upstream software alongside an added installation script. During installation, that script executed a remote shell script with root privileges.
Consequently, the attack extended beyond misleading package names. Running attacker-controlled code as root gives it extensive control over the affected system.
Another maintainer reported that rules in the open-source security tool TrustSight flagged several malicious packages.
Meanwhile, the investigation traced the payload retrieval route through a Wayback Machine URL. That address pointed to a repository named “hellscripter/install-scripts” on the GitFlic hosting service.
Researchers Identify Possible Overlap With an npm Campaign
Separately, researchers recently documented an npm malware campaign called DirtyBlanket.
That operation fetched code from a repository with the same “hellscripter/install-scripts” name, although the reported copy used Codeberg hosting.
The investigation uncovered a Linux worm that deployed the CHAOS remote-access trojan while posing as a font service. In addition, the worm injected a loader into AUR packages.
An advisory concerning DirtyBlanket also references the same Wayback Machine and GitFlic infrastructure described in the latest AUR investigation.
Nevertheless, these overlaps do not confirm that the campaigns share an operator. The relationship between the two operations remains unverified.
Repository Cleanup Does Not Resolve Existing Infections
The fake Arch Linux packages follow earlier attacks against the community repository.
In June, a campaign involving 400 packages distributed credential-stealing malware with rootkit capabilities. Another attack in July prompted Arch to temporarily disable package adoption.
Although maintainers removed the latest malicious uploads, users who installed affected packages should treat their systems as potentially compromised.
The critical concern is the installation script’s privileged execution. Simply deleting the original package cannot establish whether the downloaded payload left additional malicious components behind.
0 responses to “Fake Arch Linux Packages Run Malware With Root Privileges”