Fake Arch Linux AUR packages exploit typos to run malware with root privileges

Arch Linux's AUR (Arch User Repository) was found hosting typo-squatted clones of the popular package helpers yay and paru, designed to trick users into installing malware with root-level privileges. A maintainer discovered one such package, named "yyay," which mimicked the legitimate yay tool but contained a hidden install scriptlet that downloaded and executed an external script as root during installation or upgrade. The attacker, operating under the account marchos1as, reportedly uploaded hundreds of similarly disguised packages before being banned and having their uploads removed by AUR maintainers. This marks the latest in a series of supply-chain attacks against AUR this year, following a June campaign that compromised roughly 1,500 abandoned packages to push a credential-stealing npm dependency, and a July incident severe enough to force Arch to temporarily suspend package adoption and uploads altogether.