A threat actor has uploaded malicious packages to the Arch User Repository (AUR), impersonating popular helper tools like ‘yay’ and ‘paru.’ These fake packages are designed to push malware with root privileges onto unsuspecting users’ systems. This supply chain attack vector highlights the risks associated with third-party package repositories and the need for careful verification of software sources.