Fake Arch Linux AUR packages deliver malware with root access

Malicious packages impersonating yay and paru were uploaded to the Arch User Repository, tricking users into installing malware with root privileges. The attack exploits trust in community-maintained repositories, and the extent of compromise is unclear. This highlights supply-chain risks in open-source package ecosystems.