Fake Arch Linux packages push malware with root privileges

A threat actor uploaded malicious packages to the Arch User Repository (AUR) under typosquatted names mimicking the popular AUR helper tools 'yay' and 'paru'. These packages included legitimate upstream source code but contained malicious installation scripts that executed remote shell scripts with root privileges, effectively compromising affected systems. The malicious payload was fetched from a Wayback Machine URL pointing to a personal repository hosted on a Russian hosting service. The AUR team responded by banning the malicious user account and removing the packages. There are potential links to a Linux worm campaign known as 'DirtyBlanket', but no confirmed relation. Users who installed these packages should consider their systems compromised.

Systems that installed the malicious packages were potentially compromised with malware running with root privileges, allowing full system control by the attacker. This could lead to unauthorized access, data theft, persistence, and further malware deployment. The malicious installation script executed a remote shell script with root privileges, significantly increasing the severity of the compromise.

The malicious packages have been removed from the Arch User Repository and the uploader's account banned. Users who installed the suspicious packages should assume their systems are compromised and take immediate remediation actions such as reinstalling the system or restoring from a known good backup. There is no official patch since this is a supply chain compromise; remediation depends on user action. Monitor official Arch Linux communications for further guidance.