DEV Community

Anoymask
Anoymask

Posted on

Arch Linux AUR: Typosquatted yay and paru Packages Execute Remote Scripts with Root Privileges

#security #threatintel

1. Basic Information

Malicious install scriptlets execute with root privileges during package installation or updates via pacman. Low-privilege builds using makepkg must be evaluated separately from root-privileged host installations, and administrators must verify execution artifacts and credentials on affected hosts.

2. Executive Summary

Public analysis of AUR packages mimicking yay and paru revealed a path where install scriptlets added to legitimate upstream code execute remote scripts as root without validation during installation or updates. Although package removal and account suspensions have been reported, execution on individual hosts requires separate verification.

3. Attack Flow

Installation and Update Path Shown by Public Static Analysis

  1. A user acquires an AUR package resembling yay or paru and builds it using makepkg.
  2. During package installation or updates via pacman, the top-level logic of the added install scriptlet executes with root privileges.
  3. The scriptlet retrieves a script from GitFlic via a Wayback Machine URL. The retrieved item is not included in the source array and lacks a checksum.
  4. The retrieved script is passed to a shell for execution. Static analysis indicates this execution path, which must be distinguished from actual execution and compromise confirmation on individual user hosts.

4. Attacker Position and Execution Location

  • A software supply chain attacker who publishes packages to the AUR and manages external repositories.

5. Victim and Administrator Perspective

  • Victims and Users: Appears as a standard AUR helper installation and build process, potentially overlooking subtle differences in package names.
  • Administrators: Manifests as external downloads via makepkg or package managers, root shell activity, and unknown services or persistence configurations.

6. Success and Failure Conditions

Success Conditions

  • The user installs or updates the target package and executes the install scriptlet as root.
  • The external script retrieval destination is reachable, and the returned code is passed to the shell.

Failure Conditions and Mitigations

  • Restrict installations to official repositories or verified AUR packages, and verify PKGBUILD, install scripts, and source checksums.
  • Inference: In addition to building in low-privilege and isolated environments, inspect install scriptlets before installing them on the host, and block unverified remote script retrieval and execution. Build isolation alone does not protect against subsequent root installation steps.

7. Impact of Successful Exploitation

  • Arbitrary script execution with root privileges can lead to a full host compromise.
  • Access to source code, SSH keys, tokens, build secrets, and secondary impacts on the software supply chain are possible.

8. Observable Logs

The following items are candidates for investigation within your organization. Availability depends on products, permissions, log settings, and retention periods, and the absence of records does not prove the absence of compromise.

  • Email: No email vectors specific to this incident have been confirmed.
  • Proxy / SWG / DNS: Inference: If connections from installation or update processes to the Wayback Machine or GitFlic are recorded, correlate their timestamps with the retrieval destinations.
  • Endpoint / EDR: Inference: Verify retrieval tools, shell execution, and the executing user spawned by pacman install scriptlets. Distinguish between makepkg builds and root installations.
  • Identity / IdP: Inference: Check for the use of SSH keys, Git tokens, and cloud credentials stored on compromised hosts.
  • SaaS / Cloud: Inference: Review access from compromised hosts to Git hosting, CI/CD, and package registries.
  • Network: Inference: Confirm external script retrieval around the time of installation or updates. Subsequent C2 activity remains an unconfirmed investigation candidate.

9. Determining Attack Success

Confirmed in Public Information

The aur-general post outlines the static execution path of the install scriptlet. This must be distinguished from records observing root execution on individual user endpoints or validation environments.

Internal Evaluation Criteria

  • Initial Execution Confirmed: Criteria: This stage is reached when evidence confirms root script execution from an install scriptlet on organizational endpoints. Public analysis shows static execution paths and does not indicate observed execution success on individual hosts. Scope: Internal evaluation criteria. Distinguish public static analysis from actual execution evidence.

Separate contact, execution, persistence, data collection, and exfiltration, and do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Initiate investigation from similarity-named packages such as yyay, author marchos1as, and retrievals from GitFlic.
  • Initial Verification: Check pacman and AUR helper history, package caches, PKGBUILD, and installation timestamps.
  • Endpoint and Server Investigation: Preserve processes, shell history, systemd, cron, authorized_keys, and added binaries.
  • Authentication and Cloud Investigation: Verify usage of SSH, Git, registries, and cloud tokens after the suspected compromise time.
  • Subsequent Actions: Trace unauthorized access to developer repositories, CI/CD pipelines, and package publication workflows.
  • Containment: Isolate hosts, rotate credentials, rebuild from trusted images, and remove malicious packages.
  • Categorization: Separate package acquisition, builds, root script execution, credential usage, and secondary supply chain impacts.

11. Defense and Detection Ideas

  • Single Events: Inference: Detect undeclared downloads and root shell execution originating from package installation or update processes.
  • Timeline Correlation: Correlate AUR acquisition, installation hooks, external scripts, root processes, and credential access.
  • Threat Hunting: Search all Arch Linux hosts for package names resembling yay or paru alongside external script retrieval activity.
  • Log Limitations: Package manager logs alone do not reveal commands executed inside scripts; process and network telemetry are required.
  • Priority Mitigations: Prioritize AUR allowlist operations, PKGBUILD reviews, isolated builds, and build environments devoid of secrets.

12. Facts, Inference, and Hypothesis

Facts

  • The aur-general post dated October 13, 2026, reports packages mimicking yay and paru and the contributor marchos1as.
  • At least yyay used a legitimate upstream tarball while adding a top-level malicious install scriptlet.
  • Published static analysis indicates that the install scriptlet executes remote scripts as root without checksum validation during installation or updates.
  • BleepingComputer reported the removal of related packages and the suspension of the contributing account marchos1as.
  • The malicious scriptlet uses a Wayback Machine URL as a retrieval vector to connect to hellscripter/install-scripts on GitFlic.
  • Links to DirtyBlanket or CHAOS are based on similarities, and attribution remains unconfirmed.

Inference

  • Adding or replacing a single character in AUR helper names targets search and typo errors, necessitating diff verification of PKGBUILD and install scripts alongside package names.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under "Open Questions and Further Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1195.002 Supply Chain Compromise: Compromise Software Supply Chain high Distributed malicious install scripts embedded in AUR packages. Source
T1059.004 Command and Scripting Interpreter: Unix Shell high Executes remote shell scripts with root privileges. Source

14. Open Questions and Further Investigation

  • Download and installation counts, executed final payloads, number of compromised hosts, the true identity of the contributor, and connections to DirtyBlanket or CHAOS remain undetermined.

15. Impact on SOCs and Organizations

Even if legitimate upstream checksums match, the safety of added install scriptlets is not guaranteed. Organizations using Arch Linux for development terminals or build environments should manage low-privilege builds and root installations as separate trust boundaries, and review both PKGBUILD and scriptlets.

16. Summary by Role

  • For SOCs: Verify AUR helper installations, pipe execution from curl or wget to shells, root processes, and GitFlic communications.
  • For Administrators: Audit environments for the presence of similarity-named packages like yyay, and isolate and rebuild hosts on which the malicious script ran assuming compromise.
  • For Users: Review AUR package names and PKGBUILD files, and avoid building or installing software from unofficial or untrusted sources.

Top comments (0)