What happened

• A threat actor uploaded malicious Arch User Repository (AUR) packages that impersonated the yay and paru AUR helpers. They were detected on October 13. [S1]
• Each package bundled the legitimate upstream code with a malicious install scriptlet. [S1]
• The scriptlet fetched a remote shell script and executed it with root privileges. [S1]
• The script was fetched through a Wayback Machine URL that pointed to a personal repository hosted on GitFlic. [S1]
• One reported package name is 'yyay'. [S1]

Timeline

Detect

Install-time fetch from Wayback Machine or GitFlic · Linux process events (auditd or EDR)

index=* (process=*curl* OR process=*wget*) (process=*web.archive.org* OR process=*gitflic*) | stats earliest(_time) as first latest(_time) as last values(parent_process) as parent values(process) as cmd by host user

A hit means: A command line on the host fetched content from the Wayback Machine or GitFlic with curl or wget. This matches the reported download step [S1]. Check whether the parent chain leads to pacman or makepkg, and whether the user was root.

Proxy/DNS traffic to Wayback-wrapped GitFlic content · Web proxy or DNS logs

index=* (url=*web.archive.org*gitflic* OR query=*gitflic* OR url=*gitflic*) | stats count earliest(_time) as first by src user url query

A hit means: A host requested GitFlic content directly or through the Wayback Machine. This matches the reported delivery path [S1]. Correlate the source IP with Linux hosts and the time of any package installs.

Typosquat package installed · pacman log (/var/log/pacman.log) or shell history

index=* ("installed yyay" OR "yay -S yyay" OR "git clone" yyay OR "makepkg" yyay) | table _time host user _raw

FROM logs-* | WHERE event.original LIKE "*installed yyay*" OR event.original LIKE "*yay -S yyay*" OR (event.original LIKE "*git clone*" AND event.original LIKE "*yyay*") OR (event.original LIKE "*makepkg*" AND event.original LIKE "*yyay*") | KEEP @timestamp, host.name, user.name, event.original | SORT @timestamp

A hit means: The reported typosquat package 'yyay' was built or installed on the host [S1]. If the install completed, its scriptlet ran as root. Treat the host as compromised.

Verify

• A true positive needs the typosquat package name, or a pacman/makepkg install that spawned a shell which fetched from web.archive.org or GitFlic [S1].
• Confirm the package name exactly. The legitimate packages are 'yay' and 'paru'; 'yyay' is the reported fake [S1].
• Benign look-alikes: researchers and developers browsing web.archive.org; legitimate GitFlic use; and normal yay/paru installs, which also run makepkg and fetch sources. The legitimate installs do not pipe a remote script into a shell as root.
• If the host keeps the PKGBUILD or .install file in an AUR build cache (for example ~/.cache/yay or ~/.cache/paru), read the install scriptlet for a download-and-execute line.

Scope

Affected

• Arch Linux (and Arch-based) systems that installed the typosquatted yay or paru packages from the AUR [S1]

Only if

• The user installed the impersonating AUR package (for example 'yyay') rather than the legitimate helper [S1]
• The install scriptlet ran, which happens during package installation with root privileges [S1]

Not affected if

• The host does not run Arch Linux or does not use the AUR

Enumerate

• Hosts running Arch Linux or Arch-based distributions, including developer laptops, VMs and WSL instances
• Installed AUR (foreign) packages on those hosts ('pacman -Qm'), checked for yay/paru typosquats
• Users with sudo on those hosts, and credentials, SSH keys and tokens stored on them
• Network logs for web.archive.org and GitFlic access since early October

Contain

• Isolate any host with a hit from the network. Keep it powered on if memory capture is possible.
• Preserve evidence: /var/log/pacman.log, the AUR build cache, the package's .install scriptlet, shell history and process/network logs.
• Block or alert on install-time fetches to GitFlic. Watch Wayback Machine fetches from Linux servers.
• Rotate credentials, SSH keys and API tokens that were present on or reachable from the host. Exposure that already happened cannot be undone.
• Rebuilding a host destroys on-disk evidence and cannot be undone. Image the disk first.

Eradicate

• Remove the typosquat package. The script ran as root, so removing the package alone cannot be trusted to clean the host.
• The sources do not describe the second-stage payload or its persistence. Reimage affected hosts rather than cleaning them in place.
• Root cause: an AUR package installed without checking its name and PKGBUILD [S1]. Restrict or review AUR use on corporate hosts.

Recover

• Before restoring, confirm the rebuilt host has only the legitimate yay/paru (or no AUR helper) and that its credentials have been rotated.
• Afterwards, monitor the restored host and the rotated accounts for outbound traffic to GitFlic or the Wayback Machine and for unusual logins.

Re-enter the loop when

• The second-stage payload is analysed and publishes new IoCs, domains or persistence mechanisms.
• Additional typosquat package names (for example the paru fake) are disclosed.
• Arch Linux or a CERT publishes an advisory that changes the timeline or scope.
• Hits appear on hosts that never installed a typosquat, which would point to another delivery path.

Debrief

• Record which hosts used the AUR, how the package was chosen, and how long it was installed.
• Record whether corporate policy permits AUR helpers on managed hosts.
• Gap: the sources do not name the payload's function, any C2, or persistence.
• Gap: the exact paru typosquat name and the full GitFlic repository URL are not given.
• Gap: there is no count of installs and no date the packages were first uploaded.

Detection coverage — checked automatically

Checked automatically 2026-11-10 07:59Z from public sources: 1 published, 17 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 07:59Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• The IoC 'http://hellscripter/install-scripts' has no valid domain and looks truncated or garbled. Confirm the actual Wayback Machine/GitFlic URL against the original reporting.
• What does the second-stage script do, and does it persist or steal credentials?
• What is the name of the paru typosquat, and were there other packages?
• Have Arch Linux AUR maintainers removed the packages, and when were they first uploaded?
• No primary source (Arch Linux, AUR moderators, CERT) is in the input.

Sources

• [S1] https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/ · BleepingComputer

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.