Fake Arch Linux packages push malware with root privileges

A threat actor uploaded malicious packages to the Arch User Repository (AUR), impersonating popular AUR helper tools yay and paru. The fake packages were designed to push malware with root privileges onto victim systems. AUR is a community-driven repository for Arch Linux users, making it a high-value target for supply chain attacks. Because AUR packages can request elevated privileges during installation, malicious packages can gain root-level access. This attack highlights the risks associated with community-maintained package repositories where packages are not officially vetted. Users who installed the trojanized versions of yay or paru may have had their systems fully compromised. The incident underscores the importance of verifying package authenticity and reviewing PKGBUILDs before installation on Arch Linux systems.