Fake Arch Linux AUR packages exploit typos to run malware with root privileges

October 15, 2026 · 5:12 pm 2 sources

Image: BleepingComputer

Coverage

Coverage

• Fake Arch Linux packages push malware with root privileges
  BleepingComputer · October 15, 2026 17:12
  A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]
• Fake Arch Linux AUR packages exploit typos to run malware with root privileges
  Help Net Security · October 16, 2026 09:58
  Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted build scripts for…