Executive Summary
A threat actor identified as 'marchos1as' targeted the Arch User Repository (AUR) by uploading malicious, typosquatted packages designed to impersonate popular helper tools 'yay' and 'paru'. The campaign, detected in October 2026, utilized trojanized installation scripts to gain root privileges on victim systems. The AUR maintainers have since banned the responsible account and removed the affected packages.
Technical analysis reveals that the malicious packages contained legitimate upstream code coupled with a scriptlet that fetched a second-stage payload via a Wayback Machine URL pointing to a Russian hosting service, GitFlic. This activity has been linked to a broader campaign named 'DirtyBlanket,' which previously involved an npm-based worm that deployed the CHAOS remote access trojan (RAT) disguised as a font service.
The impact is significant for Arch Linux users who rely on the AUR for third-party software, as the attack specifically exploited the trust in community-maintained tools to achieve high-privilege execution. This event highlights persistent supply-chain vulnerabilities within community-driven package repositories and the recurring use of the CHAOS RAT in cross-platform ecosystem attacks.