Security52 mOctober 16, 2026, 00:12

Fake Arch Linux packages in AUR push root-level malware

A user named marchos1as uploaded malicious packages to the Arch User Repository, typosquatting the popular yay and paru AUR helpers. The install script executed a remote shell script with root privileges; the account was banned and the packages removed.

BleepingComputer

Open source

Fake Arch Linux packages in AUR push root-level malware

Malicious AUR packages appeared on October 13 under user marchos1as
Install script ran a remote shell script with root privileges
Payload was fetched via Wayback Machine and GitFlic hosting
Account banned and packages removed from the repository

#ArchLinux#AUR#Yay#Paru

AI-Built Torrent Site TorrentClaw Scans Downloads to Catch Fakes and Malware

Security

Fake ChatGPT ads trick Windows users into downloading malware via ClickFix

Security

Hackers host fake ChatGPT model on official site to spread ClickFix malware

Software

Fake Arch Linux packages in AUR push root-level malware

AI-Built Torrent Site TorrentClaw Scans Downloads to Catch Fakes and Malware

Fake ChatGPT ads trick Windows users into downloading malware via ClickFix

Hackers host fake ChatGPT model on official site to spread ClickFix malware

Omarchy gains $18.5M in backing, fresh converts – and fierce critics