Fake Arch Linux AUR packages exploit typos to run malware with root privileges

Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted build scripts for proprietary programs, beta builds and older software versions that the official repositories do not carry. Yay and paru, known as AUR helpers, search the AUR for software and ...

Published 16-Oct-2026 19:00 UTC · First seen 16-Oct-2026 14:33 UTC

Sources

• Help Net Security · 16-Oct-2026