Malware · Application Security
Fake Arch Linux AUR Packages Used Typos to Install Malware as Root
Attackers uploaded fake Arch Linux AUR packages with names similar to popular tools. Users who mistyped package names risked installing malware with full system privileges.
Ross GrantUpdated 3 min read
The short version
Attackers uploaded fake software packages to a popular Arch Linux community repository. These packages had names similar to trusted tools, hoping users would mistype and install them by accident. The fake packages secretly installed malware with full system access. If you use Arch Linux and installed a package with a misspelled name, you should check your system.
What happened?
Attackers uploaded fake packages to the Arch User Repository (AUR) for Arch Linux, mimicking popular helper tools yay and paru. Users who mistyped the package names risked installing malware that ran with root privileges. The malicious packages were quickly removed after being reported by the community.
Attackers Target Arch Linux Users with Typo-Trick Packages
Attackers uploaded fake packages to the Arch User Repository (AUR), a popular community-driven software source for Arch Linux users. These packages mimicked two widely used helper tools, yay and paru, but used slightly misspelled names such as "yyay". The aim was to catch users who made a typo when installing software from the AUR.
AUR helpers like yay and paru are command-line tools that automate finding, building, and installing software from the AUR. Many Arch Linux users rely on these tools for daily software management.
How the Malicious Packages Worked
According to BleepingComputer (opens in a new tab) and Help Net Security (opens in a new tab), the malicious packages contained the real code from the legitimate yay and paru tools. However, they also included a hidden installation script. When a user installed the fake package, this script downloaded and ran a remote shell script with root privileges. This means the attacker could run any command on the victim's computer with full system control.
The attacker left the usual install functions empty to make the package look harmless at first glance. The malicious command was placed outside these functions, making it harder for casual reviewers or automated tools to spot the threat. The script was fetched from a personal repository hosted on a Russian code hosting site.
Community Response and Removal
The attack was first reported on the Arch Linux mailing list on 13 October. Community members quickly confirmed the presence of malware in the packages. Maintainers banned the attacker’s account and removed all related packages from the AUR within an hour of the initial report.
AUR maintainer Andreas Reichel warned that the packages were designed to blend in with legitimate ones, using the same source code and URLs but with a slightly different name and a hidden malicious script. Another maintainer, DeepChirp, confirmed that the packages had been deleted and the user banned.
Previous Incidents and Ongoing Risks
The AUR has been targeted by similar attacks before. In June, attackers took over abandoned packages and added malicious code, affecting an estimated 1,500 packages. In July, another malware wave led to a temporary suspension of package adoption and uploads.
There is some overlap between this incident and a previous npm campaign called "DirtyBlanket", which also used scripts from the same code repository. However, it is not yet confirmed if the two attacks are related.
What Users Should Do
Arch Linux users who installed packages with misspelled names like "yyay" or "paru" from the AUR should assume their systems may be compromised. The advice is to take immediate action, such as checking for unauthorised changes, resetting credentials, and reinstalling the system if necessary. Users should always double-check package names and review installation scripts before proceeding, especially when using community repositories.
Ongoing Uncertainties
At the time of writing, these reports are based on secondary sources. There is no official statement from Arch Linux or a government agency. The full impact and the number of affected users are not yet known.
Claimed vs confirmed
- Unconfirmed
Hundreds of AUR packages were mass uploaded with malware.
Claim made in a mailing list thread; only a small number of packages are confirmed as malicious so far.
- Unconfirmed
The attack is linked to the 'DirtyBlanket' npm campaign.
Researchers note overlap in code sources, but no direct link has been confirmed.
The impact
- Money
- There is no public estimate of financial loss. Under EU GDPR, fines for breaches involving personal data can reach €20 million or 4% of global turnover, but it is unclear if personal data was compromised.
- Reputation
- This incident may affect trust in the AUR and community-maintained repositories, especially after similar attacks earlier in the year.
- Customers
- Arch Linux users who installed the fake packages are at risk of full system compromise. They should check for unauthorised changes and consider reinstalling their system.
Why it matters
Anyone using Arch Linux and the AUR could be affected if they mistyped a package name. Installing a fake package could give an attacker full control of your computer. This shows the risks of using community-maintained software sources without careful review.
How does it work?
Attackers used typosquatting, uploading packages with names similar to legitimate ones. The fake packages included a hidden installation script that downloaded and ran a remote shell script as root, giving attackers full control of the system.
Key points
- Attackers uploaded fake AUR packages with names similar to popular tools.
- The malware ran with root privileges if installed, giving attackers full control.
- Community members detected and removed the malicious packages quickly.
- Users should double-check package names and review installation scripts.
- There is no official statement from Arch Linux yet; the full impact is unclear.
Sources
BleepingComputer
Reference
- Fake Arch Linux packages push malware with root privileges (opens in a new tab)
bleepingcomputer.com
- Fake Arch Linux packages push malware with root privileges (opens in a new tab)
Help Net Security
Reference
