Affected Systems
Arch Linux users who installed typosquatted packages from AUR (Arch User Repository) uploaded by user "marchos1as" between October 13-15, 2026. Malicious packages include "yyay" and similar variants impersonating legitimate AUR helpers yay and paru. All Arch Linux derivatives using AUR are affected.
Exploitation Status
Active exploitation confirmed. Malicious packages were live in AUR from October 13, 2026 until removal. Payload executed remote shell script with root privileges during installation. Account banned and packages removed by AUR maintainers. Possible connection to DirtyBlanket npm campaign and CHAOS RAT deployment.
Business Impact
Users who installed affected packages granted attackers root-level access to their systems. Malicious installation scripts fetched and executed remote payloads from GitFlic (Russian hosting) via Wayback Machine URLs. Potential deployment of CHAOS remote-access trojan and credential-stealing malware with rootkit capabilities. Full system compromise should be assumed for affected hosts. No CVE assigned as this is a supply chain attack rather than software vulnerability.
Urgency
🔴 Immediate
Recommended Actions
- Immediately audit all Arch Linux systems for installation of packages from user 'marchos1as' or typosquatted yay/paru variants (yyay, etc.) in AUR history logs and package manager logs
- Isolate and rebuild any systems that installed suspicious packages between October 13-15, 2026; assume full compromise with root access
- Rotate all credentials (SSH keys, passwords, API tokens) for users and services on affected systems
- Monitor network traffic for connections to GitFlic domains and Wayback Machine URLs pointing to hellscripter/install-scripts repositories
- Implement TrustSight or similar AUR package scanning tools to detect malicious install scripts before execution; review all AUR package installations manually before building