Fake yay and paru packages hit the Arch User Repository. Their install ran as root.
By Lior AharonovFounder, 7IT Solutions ·
On 13 October 2026 the Arch User Repository team found packages from the user marchos1as that impersonated the yay and paru helpers, one of them named yyay. They bundled real upstream code with an install script that ran a remote shell script with root privileges. The account was banned and the packages removed, BleepingComputer reports.
A developer laptop or build box holds your SSH keys, cloud tokens and signing keys. One typo in a package name, and a stranger's script runs with every permission that machine has.
If anyone on your team installed a yay or paru look-alike from the AUR in October, treat that machine as compromised: rebuild it and rotate every key and token it held.
A package name is not an identity. Read the build script before you type your password, every time.
Lior Aharonov · my takeSources
- BleepingComputer: Fake Arch Linux packages push malware with root privileges bleepingcomputer.com
Researched with AI tools; every fact is checked against the linked sources.