Fake Arch Linux package hid a script that could run attacker-controlled code as root

A report shared on the Arch Linux mailing list found that a package impersonating the popular yay software helper could download and execute external code with full system privileges. The warning followed an Oct. 13 report of lookalike packages uploaded to the Arch User Repository (AUR).

Key takeaways

• The examined package, yyay, combined genuine yay source code with a malicious installation script
• Its source archive passed a checksum check, but that check didn’t cover the external script
• The findings establish a dangerous execution mechanism, without confirming what happened on users’ computers

A genuine application can hide a dangerous installer

The AUR is a community-driven collection of package build instructions for Arch Linux users. These instructions help users compile and install software not available through Arch’s official repositories.

In this case, an account named “marchos1as” uploaded packages with names resembling familiar AUR helpers. A monitoring log shared by community member Emiliano Gandini Outeda listed 15 suspicious names, including yyay, yaay and yayy.

The spelling variations could lead someone looking for yay to select an impersonation. The log doesn’t establish how many people installed them.

Andreas Reichel’s mailing-list post shared an examination of yyay. It described a package that referenced yay’s legitimate upstream project and used its genuine source archive, while adding a separate malicious installation file.

The checksum passed, but it didn’t cover everything

The analysis showed the source archive passing its SHA-256 checksum check. However, the installation file contained a command that fetched an unrelated script and passed it directly to a shell.

That external script wasn’t part of the package’s declared sources and had no checksum. Its Wayback Machine URL pointed to a personal GitFlic project without specifying a fixed archive timestamp.

The dangerous command also sat outside the installation functions, which contained apparently harmless instructions. According to the posted findings, this placement caused it to execute as root when the package manager processed the script during installation or an upgrade.

What the findings confirm and what’s still unknown

Root access gives software broad control over a Linux computer, including the ability to change system files and access other users’ data.

The posted examination warned that the downloaded code could steal credentials, install a backdoor or deploy a rootkit. These outcomes are possibilities, not documented activity on an infected computer. The post also doesn’t establish the final payload delivered to users or identify confirmed victims.

What to check before installing an AUR package

Check the exact package name against the legitimate project’s installation instructions. Small spelling differences deserve attention, especially when the package claims to provide a widely used tool.

Review the PKGBUILD and any associated .install files before proceeding. Look beyond the source archive: commands that download and immediately execute external scripts introduce another source of code to assess. Repeat that review when updates change installation instructions.

If you’re unsure what a script does, ask someone you trust to examine it before approving installation. Prefer a package from Arch’s official repositories when it meets your needs.

If you installed a suspicious package, treat the computer as potentially compromised. Stop using it for sensitive accounts while investigating. Removing the package alone may leave changes made by the downloaded code behind.

From a clean device, revoke potentially exposed sessions and replace credentials that the affected computer could access. If you can’t establish what ran or what it changed, reinstalling from trusted media offers a more reliable recovery path.

For another example of attackers targeting software distribution, read Bitdefender’s coverage of the Xubuntu website compromise.

FAQ

Did attackers compromise the legitimate yay project?

The cited examination concerns an impersonating package named yyay. It doesn’t establish a compromise of yay’s upstream project.

Does downloading a suspicious package mean its installation script ran?

Downloading files and installing a package are different actions. The reported root execution occurred during installation or an upgrade.

Can a package be dangerous even if its checksum passes?

Yes. A checksum check covers a particular file; separate installation scripts can introduce additional code.