AUR Malware Campaign: Small helper script to find out if you're affected

General system Pacman & AUR helpers
1

Hi fellow EndeavorOS users,

I orginally posted on Reddit and was advised to post it here too so here I am

I wrote a small shell script that scans your system for any trace of the payload in your AUR cache and system, in accordance to the findings made by `ioctl.fail` and Sonatype.

It tries to be a bit smarter than just checking against the evergrowing package list (Vector and payload name rotated already, there’s now at least `atomic-lockfile`, `js-lockfile` and `digest-js`, injected by either npm or bun or whatever via compromised PKGBUILD files.

You can find my script here: https://gist.github.com/arbaes/e29e68d9ed1513ddd80ae9cc4a6c9f0e

Feel free to if you have any comment or improvement to make on it, hopefully it will be at least helpful to some people.

Not a guarantee that you’re 100% clean of course.

References used to write the script:

| - https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
| - https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency
| - https://ioctl.fail/preliminary-analysis-of-aur-malware/

PS: Don’t run this blindly, and try to undertand what it does first.

2

Hello, im sorry for a silly question. Im completely new to EOS and its my first arch experience. I installed and updated my system only 2-3 days ago. So if I understand correctly, its possible that theres some malware in my system? So I should copy paste your script into my terminal? And if there’s something wrong its going to detect it?

3

If you haven’t installed from the aur, you will be clean. If you have, run one of the scripts that are being passed around to check if you are infected. This script is quite thorough.

If you are infected and you are a developer, change your github/lab, or codeberg (etc) keys, change your api keys, and other online credentials. Do this from an uninfected machine. Then back up your data only and reinstall the infected machine.

4

Thank you, @MyNameIsRichard@MyNameIsRichard. I think I haven’t installed anything from AUR, but will run it just to be sure.

5

post the output of
pacman -Qm
the above command will show all the foreign packages on your system.

6

@Vesna that will tell you if you have installed from the AUR.

7

Nothing? Just a clean line with my name in the beginning but then nothing

8

then you should be good and I would wait a few days before getting anything from the AUR in case you find you do need something

9

What @thefrog said.

10

Guys, I cant believe how fast your responses were!!! Youre awesome :smiley:

11

Use pacman as your package manager for the time being.

When you get the hang of what pacman, official repositories, package dependencies and so on and so forth are, then you can start getting acquainted with what AUR is by first reading this article.

Then you will know what is involved in using a PKGBUILD from AUR and building the package and installing it on your system.

Next, comes the different AUR helpers (and pacman wrappers) like yay & co.

This is of course my opinion and I think it is a more prudent way for a new-beginner to Arch.

Others may differ and they are perfectly entitled to do so.

yay seems sometimes to have achieved a degree of sacrality for some people. My impression though and it may not be the first time I got a wrong one :rofl:

12

Sorry for the silly question but does your script have to be run from any particular directory to work ?

13

No

14

@MyNameIsRichard was faster than me, but indeed no, it’ll try to detect where your AUR cache is and payload leftovers are checked via absolute path

15

Thx for that script!
I ran it on a new Big Linux install after installing some of the packages I use regularly from the AUR to see the results.

Couldn’t get the scan for eBPF rootkit maps to work though. When selecting Y instead of the default N, the terminal tab crashes.

Atomic Arch / atomic-lockfile AUR check

Locating AUR helper caches...
  using: /home/jackkileen/.cache/yay

Note: AUR activity since the campaign began (2026-06-09):
  Installed/upgraded AUR package(s) in the campaign window (Worth checking) :
    2026-06-14 betterbird-bin
    2026-06-14 floorp-bin
    2026-06-14 librewolf-bin
    2026-06-14 tor-browser-bin
    2026-06-14 waterfox-bin
    2026-06-15 deadbeef
    2026-06-15 tartube

[1/2] Looking for the malicious dependency or its delivery...
  - Local scan (scriptlets, hooks, AUR caches)... NOT FOUND
  - Check against known impacted AUR packages list... (Uses curl|wget, but can be skipped)
    Download from https://md.archlinux.org/s/SxbqukK6IA/download ? [y/N]: y
    1935 names checked, no matches with installed packages.

[2/2] Checking for payload leftovers...
  - Scan for systemd persistence fingerprint... NOT FOUND
  - Check /usr/bin/monero-wallet-gui (cryptominer staging target)... NOT PRESENT
  - Scan '/sys/fs/bpf/hidden_*' for eBPF rootkit maps... (needs root)

    Command: sudo sh -c 'ls -d /sys/fs/bpf/hidden_* 2>/dev/null'
    Run it now? (You'll be prompted for your password, but you can skip and run it yourself) [y/N]: 
    SKIPPED
16

Not sure why it crashes for you, but as the script says, you can run that command yourself:

sudo sh -c 'ls -d /sys/fs/bpf/hidden_* 2>/dev/null'

If it returns nothing, you’re good

17

Running just it and I get this…

sudo sh -c 'ls -d /sys/fs/bpf/hidden_* 2>/dev/null'
[sudo] password for jackkileen:          
[exit=2]

EDIT: Must be a Big Linux thing, I just ran it in EOS and it did indeed return nothing.

 sudo sh -c 'ls -d /sys/fs/bpf/hidden_* 2>/dev/null'       
[sudo] password for eosblu: 
[eosblu@machina ~]$
18 
Atomic Arch / atomic-lockfile AUR check

Locating AUR helper caches...
  using: /home/wombat/.cache/yay

Note: AUR activity since the campaign began (2026-06-09):
  Installed/upgraded AUR package(s) in the campaign window (Worth checking) :
    2026-06-09 brave-origin-beta-bin
    2026-06-09 pcloud-drive
    2026-06-10 librewolf-bin
    2026-06-11 brave-origin-beta-bin
    2026-06-13 python-steam
    2026-06-14 plasma6-applets-appgrid

[1/2] Looking for the malicious dependency or its delivery...
  - Local scan (scriptlets, hooks, AUR caches)... NOT FOUND
  - Check against known impacted AUR packages list... (Uses curl|wget, but can be skipped)
    Download from https://md.archlinux.org/s/SxbqukK6IA/download ? [y/N]: y
    1935 names checked, no matches with installed packages.

[2/2] Checking for payload leftovers...
  - Scan for systemd persistence fingerprint... NOT FOUND
  - Check /usr/bin/monero-wallet-gui (cryptominer staging target)... NOT PRESENT
  - Scan '/sys/fs/bpf/hidden_*' for eBPF rootkit maps... (needs root)

    Command: sudo sh -c 'ls -d /sys/fs/bpf/hidden_* 2>/dev/null'
    Run it now? (You'll be prompted for your password, but you can skip and run it yourself) [y/N]: y

[sudo] password for wombat: 

    NOT FOUND (checked as root)

=============================================================================
LIKELY CLEAN: no Atomic Arch payload found.
-----------------------------------------------------------------------------
  - You updated AUR package(s) in the campaign window.
=============================================================================
  • Seems to be working fine here. Thanks for the script, @arbaes.
19

I love that your avatar is literally a grenade with a smiley tag.. :smiley: Somewhat apt when running scripts pulled from 3rd parties. Always good to have that reminder..!

20

It’s my old gravatar, comes from Battlefield Bad Company 1 (time flies)