Heads-up: typosquatted AUR packages with a root payload (2026-10-13/14)
An AUR account uploaded about 400 typosquats of popular packages: yay/paru (yyay, ya, paur, …), Brave (brave-nightly-bin variants, brave-origin-bin, bfave-bin, …), Dropbox (dropbpx, droopbox, …) and firefox-git. Each .install scriptlet runs a remote script (gitflic.ru/project/hellscripter/install-scripts/linux.sh, via web.archive.org) as root at install and upgrade time. AUR staff banned the account and deleted the packages.
archcanary --refresh
Thanks to James Smith for the report, Emiliano Gandini Outeda for the TrustSight detection, and DeepChirp for the ban.