Fake Arch Linux AUR packages pushed malware with root privileges

Arch maintainers removed the packages after discovery, limiting exposure to users who rely on community-built helpers.

Arch Linux users were warned after attackers pushed fake AUR packages that imitated the popular yay and paru helpers and carried a malicious install script that ran a remote shell script with root privileges. The campaign was spotted on October 13, and Arch maintainers quickly banned the uploader account and removed the packages. The incident matters because AUR helpers are widely used for installing community packages, so a trojanized clone can reach developers and power users who trust the repo. The malicious payload was fetched through a Wayback Machine link pointing to a GitFlic-hosted repository, but there is no confirmation yet that this activity is tied to a separate npm worm campaign with similar infrastructure.