The Arch User Repository (AUR) is a community-driven software repository for Arch Linux, and tools like yay and paru are commonly used to build and install packages from it. A threat actor has now uploaded malicious packages to the AUR that impersonate these two popular helper tools.
The fake packages are designed to trick users into installing malware. Because yay and paru are typically run with elevated privileges to install system packages, the malicious code can execute with root privileges, giving it full control over the system.
The discovery highlights the risks of relying on community-maintained repositories. Users should verify the authenticity of packages and maintainers before installing anything from the AUR, and consider using official repositories whenever possible.