One extra “y” on Arch Linux could hand a malicious script full control of your machine

One “y” too many. Typing “yyay” instead of “yay” was enough to install, on an Arch Linux machine, a package that downloaded and ran a remote script with root privileges, meaning full control of the system.

The alert was raised on Tuesday, October 13, on the mailing list for maintainers of the AUR (Arch User Repository), the community repository where users of Arch and its derivatives publish their software build recipes. The message title mentions “hundreds” of malicious packages uploaded in bulk. No official count has been published. The packages targeted yay and paru, two widely used tools for installing software from the AUR.

A package that perfectly mimics the original

Andreas Reichel, an AUR maintainer, analyzed “yyay” with a detection tool that flagged it as malicious with 99% confidence and blocked its build. According to Help Net Security, the fake package reused the address and archive of the real yay, so the installed software was the genuine one. The trap lay elsewhere, in the script run by pacman, Arch's package manager, during installation or update.

The install functions were left empty, and the malicious command was placed next to them to go unnoticed. Andreas Reichel sees this as a deception “aimed at casual reviewers and automated scanners.” According to BleepingComputer, the script was fetched through a copy on the Wayback Machine, the web archive, pointing to a personal repository hosted on GitFlic, a Russian service.

What did that script do? No one has established it publicly. Andreas Reichel believes it could be used to steal credentials, install a backdoor or a rootkit, a program that hides deep inside the system. Nothing confirms at this stage that any machines were compromised.

A third alert since June

Another maintainer, DeepChirp, confirmed the presence of the malicious code, banned the account “marchos1as” and deleted all its packages. This is not the AUR's first attack: in June, hundreds of packages, more than 400 according to BleepingComputer, spread a credential-stealing malware. In late July, Arch temporarily suspended the adoption of orphaned packages. A campaign targeting npm, dubbed DirtyBlanket and documented by SafeDep, pulled code from a repository of the same name hosted on Codeberg, and an OSV advisory about it mentions the same Wayback Machine address and GitFlic. No link has been established at this stage between the two operations.

Arch's official repositories are not affected. The risk comes from a model where anyone can publish an install recipe, as on other community platforms: we saw it recently with the Docker Hub flaw.

How to check your machine

A simple typo may have been enough. A few checks are therefore in order on workstations and servers running Arch:

• list packages that do not come from the official repositories with pacman -Qm and look for a name close to yay or paru (yyay or another variant);
• review the installation history in /var/log/pacman.log starting from mid-October;
• before building an AUR package, read its PKGBUILD file and its install scripts (.install), not just its name;
• if a fake package was installed, treat the machine as compromised: reinstall from clean media, change passwords, and revoke the SSH keys and access tokens present on the machine.

It remains to be seen what the script really contained and how many users made the typo before October 13.