CERT24Fake Arch Linux packages push malware with root privilegesLoading data…
CERT24Threat Observatory
Period

Fake Arch Linux packages push malware with root privileges

Malicious packages were uploaded to the Arch User Repository (AUR) impersonating the popular yay and paru helper tools. The packages combined legitimate upstream code with a malicious installation script that executed a remotely fetched shell script with root privileges.

← Back to intelligence

Fake Arch Linux packages push malware with root privileges

Malicious packages were uploaded to the Arch User Repository (AUR) impersonating the popular yay and paru helper tools. The packages combined legitimate upstream code with a malicious installation script that executed a remotely fetched shell script with root privileges.