Malicious AUR Packages Removed by Arch Linux
The packages impersonated common command-line tools to execute unauthorized scripts with root privileges.
Updated on Oct. 15, 2026 in Cybersecurity
Live Poll
Do you trust community-maintained software repositories to be free of security threats?
The Arch Linux team has removed malicious packages found in the Arch User Repository that were impersonating the yay and paru command-line tools. These packages, identified on October 13, were designed to execute remote shell scripts with root privileges.
Why it matters
This incident highlights ongoing security vulnerabilities in community-maintained software repositories. It follows a significant supply chain attack in June where 400 packages deployed credential-stealing malware with rootkit capabilities, prompting temporary account restrictions in July.
The malicious packages combined legitimate upstream code with installation scripts that fetched payloads from a GitFlic URL via the Wayback Machine. These scripts were configured to run with root-level access, effectively bypassing standard user security.
The players
Arch Linux
A Linux distribution focused on simplicity and customizability that maintains a community-driven repository for user-submitted software.
Arch User Repository
A community-maintained repository for Arch users that provides a vast library of packages but lacks the strict curation of official software sources.
The details
The Arch User Repository (AUR) allows community members to publish build scripts for Arch Linux. In this instance, an actor using the account name marchos1as uploaded packages that masqueraded as popular system tools. Once installed, these packages triggered a script that established a remote connection to execute commands with root privileges, the highest level of system authority in Linux environments.
Timeline
June 2026: A supply chain attack distributed malware across 400 packages.
July 2026: Arch Linux maintainers temporarily disabled the package adoption process.
October 13, 2026: Malicious yay and paru packages were detected in the AUR.
The Tech Race
This incident follows the June 2026 supply chain attack that distributed credential-stealing malware across 400 packages. It underscores the challenges maintainers face in securing the AUR relative to the more strictly audited official software repositories.
Arch Linux users who recently installed or updated the yay or paru tools should audit their systems for unauthorized scripts. Administrators are advised to verify package sources in the AUR until further security improvements are implemented by repository maintainers.
The takeaway
Maintaining system integrity in open repositories requires vigilance against impersonation tactics. Users should monitor official Arch security announcements for updates on future hardening measures for the AUR.
Further reading
For broader trends in open-source software security, visit our coverage of Cybersecurity.
Source note: This article includes information reported by Bleeping Computer.
Live Poll
Do you trust community-maintained software repositories to be free of security threats?
