Malicious AUR Checkup Script

[swh]

Running this script mentioned by @1093i3511 in another thread

Malicious AUR packages

Nothing malicious found on my install. I guess I won’t update AUR packages at all for a week or so. As it is still an ongoing event and its uncertain if it is already over. That github repo not only contains a script to check if you’ve got one of the malicious packages on your system, but also provides an overview of the situation. And some recommendations what to do if you’re affected. Overall, as the attack vector included identity theft / impersonation of an legitimate kde maintainer via…

╰─❯  ./aur_check.sh --full
============================================================
 AUR Malware Check v2.2.0
 Campaign: atomic-lockfile / js-digest infostealer + eBPF rootkit
 Date window: 2026-06-09 to 2026-06-12
 Packages checked: 512
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages installed within campaign window.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.

--- [3] Systemd persistence check ---
  Clean: no suspicious systemd services found.

--- [4] eBPF rootkit check ---
  Clean: no eBPF rootkit traces detected.

--- [5] npm cache check ---
  Clean: no malicious packages in npm cache.

--- [6] bun cache check ---
  Clean: no malicious packages in bun cache.

============================================================
 RESULT: CLEAN - No indicators found.
============================================================

As far as I can tell with my limited knowledge, things are looking good here