Small headsup, I was informed my initial eBPF rootkit was actually weak on compromised host (sudo ls /sys/fs/bpf/hidden_*) because that rootkit hooks on the getdents64 syscall, hiding itself in the process.
Script is unfortunatly a lot more verbose in result, uses bpftool is available (most reliable) or does a direct stat() on known ioc names
So, am I OK, or should I be worried?
lmstudio-bin and brave-bin were updated more recently.
[sermor@archlinux e29e68d9ed1513ddd80ae9cc4a6c9f0e-79464ce9d55b1d50b5fb013fd243bc8d5018957f]$ ./atomic-arch-check.sh
Atomic Arch / atomic-lockfile AUR check
Locating AUR helper caches...
using: /home/sermor/.cache/yay
Note: AUR activity since the campaign began (2026-06-09):
Installed/upgraded AUR package(s) in the campaign window (Worth checking) :
2026-06-09 lmstudio-bin
2026-06-10 brave-bin
[1/2] Looking for the malicious dependency or its delivery...
- Local scan (scriptlets, hooks, AUR caches)... NOT FOUND
- Check against known impacted AUR packages list... (Uses curl|wget, but can be skipped)
Download from https://md.archlinux.org/s/SxbqukK6IA/download ? [y/N]: y
ON REPORTED LIST:
├─ vidcutter 6.0.5.3-5
│ built 2026-02-15 23:54 ([OK] built before 2026-06-09)
│ installed 2026-02-15 23:54
│ recipe /home/sermor/.cache/yay/vidcutter
│
└─ [OK] All built before the campaign: likely safe.
[2/2] Checking for payload leftovers...
- Scan for systemd persistence fingerprint... NOT FOUND
- Check /usr/bin/monero-wallet-gui (cryptominer staging target)... NOT PRESENT
- Scan for eBPF rootkit maps (hidden_pids/hidden_names/hidden_inodes)... (needs root)
Will use 'bpftool' if available, else direct stat(), to dodge a compromised getdents64().
To run it yourself instead:
sudo bpftool map list # Review suspicious maps
sudo bpftool map list | grep -E 'hidden_(pids|names|inodes)' # Known IOC names
Run it now? (you'll be prompted for your password)
[y]es / [s]how exact command / [N]o skip: y
Method: bpftool map list (asks the kernel directly)
5 map(s): 5 known-good (systemd/NetworkManager/bpftool), 0 to review.
(all maps belong to known system services; nothing unexpected)
No known-IOC map names matched; all maps belong to known system services.
=============================================================================
LIKELY CLEAN: no Atomic Arch payload found.
-----------------------------------------------------------------------------
- You updated AUR package(s) in the campaign window.
=============================================================================
But still, this other script doesn’t find anything.
[sermor@archlinux e29e68d9ed1513ddd80ae9cc4a6c9f0e-79464ce9d55b1d50b5fb013fd243bc8d5018957f]$ curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | bash
Checking for infected AUR packages (1937 total)...
Clean: None of the known infected packages were installed within 2 days of the campaigns.
Correct me if i’m wrong but the infected packages were unmaintained ones. AUR package without any owner that were adopted and injected by malicious actors. If the checker says you are not infected, chances are you are not.
Yeah. I think the impact of this attack is vastly over-estimated. If you didn’t have any of these orphans installed and didn’t install any of them during the attack, you should be fine.
Indeed. At this point in time I have yet to see someone on this forum being affected by this issue. All I see is Clean and non infected results. I have also updated multiple times since the beginning of this wave of attack as I update daily and still not infected.
You’re fine, you can inspect the build yourself if you have a doubt but the script didnt detect anything, and you build that package before it had a chance to get poised
Yes, the huge majority was orphaned packages takeover, but a few mainteners also got their account compromised. Also, i dont think the second and third waves did much damage because it was adressed pretty quickly by Arch devs
Thanks guys!
Vesna I ran the command you posted about checking if i installed from the AUR and mine returned
accounts-qml-module 0.7-7
brother-mfc-l2713dw 4.0.0-1
lib32-gst-plugins-base-libs 1.28.1-3
lib32-gstreamer 1.28.1-3
libsoup 2.74.3-4
maliit-framework 2.3.0-3
maliit-keyboard 2.3.1-4
minecraft-launcher 1:2.1.3-3
presage 0.9.1-3
reiserfsprogs 3.6.27-7
splix 2.0.1-2
xwaylandvideobridge 0.4.0-3
The minecraft launcher and the brother driver are the only ones i added but i don’t use the minecraft launcher anymore. I’m also noobish and are unsure how to safely remove these packages. But i can go to the arch wiki and try find how to do it there too.
give me the full output of the script
Please disregard i managed to get the script to run user error it came back saying all clean
Atomic Arch / atomic-lockfile AUR check
Locating AUR helper caches…
using: /home/lionfire01/.cache/yay
Note: AUR activity since the campaign began (2026-06-09):
Last AUR install/upgrade: 2026-05-04 xwaylandvideobridge
(Before 2026-06-09: Risk is lower but not zero (not a guarantee))
[1/2] Looking for the malicious dependency or its delivery…
[2/2] Checking for payload leftovers…
Scan for systemd persistence fingerprint… NOT FOUND
Check /usr/bin/monero-wallet-gui (cryptominer staging target)… NOT PRESENT
Scan ‘/sys/fs/bpf/hidden_*’ for eBPF rootkit maps… (needs root)
Command: sudo sh -c ‘ls -d /sys/fs/bpf/hidden_* 2>/dev/null’
Run it now? (You’ll be prompted for your password, but you can skip and run it yourself) [y/N]: y
[sudo] password for lionfire01:
NOT FOUND (checked as root)
Thanks for your prompt reply i appreciate it a bunch.