BleepingComputer reported on 15 October that a user named marchos1as uploaded malicious packages to the Arch User Repository (AUR). Their names mimicked yay and paru, tools that help install AUR software. The AUR is a community store of build scripts for Arch Linux. A mailing-list thread titled "hundreds of aur packages were mass uploaded with malware" raised the alarm on 13 October. Members found real upstream code paired with an install script that ran a remote shell script as root. The AUR team banned the account and removed the packages, BleepingComputer said.
Maintainer Andreas Reichel said the fake yay package, named 'yyay', copied the real source but its install script gave it away. He said the payload came through a Wayback Machine link to a personal repository on GitFlic, a Russian host. BleepingComputer noted that SafeDep reported an npm campaign using a repository of the same name on Codeberg. It said no link between the two is confirmed. The thread title points to hundreds of packages, but the sources give no confirmed package or install count. They also do not say what the script did next.
BleepingComputer noted that the AUR was hit before. In June, 400 packages spread credential-stealing malware. In July, Arch temporarily disabled package adoption. Helper tools run installs, so a fake helper's install script runs as root. Teams that allow AUR packages on work machines are trusting the person who uploaded them. BleepingComputer said anyone who downloaded the packages should assume their system was compromised.