Fake Arch Linux packages push malware with root privileges

This is a classic supply chain attack targeting the Arch Linux community. Threat actors uploaded malicious packages to the AUR impersonating yay and paru, two essential helper tools for managing AUR packages. The kicker? The malware executes with root privileges, giving the attacker full control over the compromised system.

Technical Breakdown: – TTPs: Supply chain compromise (T1195), User Execution via malicious package install (T1204.002), Abuse of Trusted Relationship (T1199). – IOCs: The malicious packages were named similarly to the legitimate tools (e.g., yay-bin vs. yay). Specific hashes and C2 domains are not publicly available yet, but the attack vector is clear: typosquatting in the AUR. – Affected Systems: Any Arch Linux system where a user ran yay -S <malicious_package_name> or paru -S <malicious_package_name>.

Defense: – Verify package signatures before installation. Legitimate AUR packages are signed by maintainers. – Use paru or yay with --verify to check PGP signatures. – Pin your AUR helpers to specific, known-good versions and avoid blindly installing from the AUR without manual review of the PKGBUILD file.

This is a good reminder that even trusted package managers can be weaponized. Always verify the source before running anything with sudo.

Source: https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/