Fake Arch Linux AUR packages exploit typos to run malware with root privileges

Researchers and AUR maintainers discovered typo‑squatted Arch Linux AUR packages (e.g., 'yyay') that contained malicious install scriptlets which download and execute code with root privileges during package installation; scanners flagged the packages and maintainers removed and banned the uploader, noting this as part of broader recent waves of AUR supply‑chain malware that may have affected many packages and prompted Arch to suspend uploads.