Typosquatted Arch Linux AUR package imitating yay runs attacker code as root at install time

A malicious Arch User Repository account uploaded typosquatted packages, including yyay, which imitates the popular yay helper, with an install scriptlet that runs arbitrary downloaded code as root at pacman install or upgrade time. The payload was pulled from a personal project on a Russian code-hosting site, and the attacker left the normal install functions empty while placing the malicious command outside them. A malware scanner flagged yyay with high confidence, and a maintainer confirmed the payloads, banned the account, and deleted its packages. The incident follows an earlier AUR malware wave in July that briefly halted uploads across the repository.

Check

Verify AUR package names carefully before installing, review PKGBUILD and install scriptlets for commands that fetch and run remote code, and avoid lookalikes of yay and paru.

Affected

Arch users who installed the typosquatted AUR package ran attacker-controlled code as root at install time, risking credential theft, backdoors, or rootkits.

Fix

Remove any suspicious AUR packages, inspect systems that installed them for root-level compromise, rebuild from a clean state if needed, and install only vetted AUR helpers.