On Tue, 2026-10-13 at 20:51 -0600, James Smith wrote:
> the user marchos1as[1] typo squated popular packages eg yay/paru
Not very intelligent though: 99% confidence on Malware is rare.
==> Validating source files with sha256sums...
yyay-13.0.1.tar.gz ... Passed
scanning yyay (5 files) ...
[ MAL! ] yyay (confidence 99%)
4 critical findings and 1 warning indicate malicious behaviour; do not build.
[critical] a source disguised or impersonating a forge (PKGBUILD)
The package presents itself as a straightforward repackaging of the
legitimate 'yay' AUR helper (same upstream URL, same source tarball), but
the package name 'yyay' and the malicious install scriptlet reveal it is a
trojanised impersonation designed to blend in with the real package.
[critical] install scriptlet changes the live system as root (yyay.install)
The scriptlet runs arbitrary downloaded code as root on the live system at
pacman install/upgrade time. Whatever 'linux.sh' currently serves —
credential theft, backdoor installation, rootkit deployment — executes with
full root privileges on the installing machine.
[critical] package text addressed to a scanner (yyay.install)
The post_install and post_upgrade functions are deliberately emptied
('true') to create the appearance of a benign scriptlet, while the actual
malicious payload sits outside any function at the file's top level — a
structural deception aimed at casual reviewers and automated scanners.
[critical] pipes an unrelated host's script into a shell (yyay.install)
This line sits at the top level of the scriptlet, outside any function, so
it executes unconditionally as root on every install and upgrade. The URL
points to a personal project ('hellscripter/install-scripts') on gitflic.ru
— a host with no relationship to yay/yyay or its upstream
(github.com/Jguer/yay). The web.archive.org wrapper does not pin a snapshot
timestamp, so the content served is not fixed. The fetched script is not in
source=() and has no checksum.
[warning] other behaviour warranting review (yyay.install)
INSTALL-003 Network in install script (static rule)
[info] remote source archive not reviewed (.SRCINFO)
The build compiles from the upstream yay release tarball; its build hooks
(Makefile) were not reviewed.
!! Build blocked: 1 package(s) flagged MALICIOUS
