Greetings, I’m on the AUR mailing list and there has been huge influx of packages that were maliciously taken over today. Please check the PKGBUILD and be wary especially of new npm depencencies, particularly one named “atomic-lockfile”, but there might be others.

What I said above goes for you too. If you or anyone thinks I am breaking any rules of the forum, flag me! But don’t you or anyone put yourselves in a position to patronize me. Get it?

If you don’t want to be patrionized why are you trying to patronize me I wonder.

One of the members over at Garuda posted a script to check for infected packages… [eosblu@machina Desktop]$ ./maltest.sh Checking for infected AUR packages (494 total)... Clean: None of the known infected packages were installed within 48 hours of the campaign.

Guys, don’t bury actual meaningful contributions and shared information about the actual situation with random noise. Be reasonable.

The link to the script to check for malicious packages in the AUR that I’ve posted early originated from the arch linux discord channel, in case you didn’t trust an private github account that may seem arbitrary and not actually affiliated to the arch dev team directly, which is actually an concern …

Earlier today, similar script originating from a moderator on Cachy’s Forum: [image] Malicious AUR Checkup Script Pacman & AUR helpers From CachyOS Moderator cscs TL;DR Here’s what I got… ─❯ curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | ba…

If I understand correctly it’s over 900 now (New Wave of malicious packages?) Re: AUR REPORT THREAD - Aur-general - lists.archlinux.org Edit: according to some other thing (some GitHub script) it seems to be 1577 as of right now

FYI: Arch User Repository hit by a large-scale malware campaign, with maintainers racing to roll back malicious commits and lock out bad actors. If you’re an Arch Linux user, today would not be a good day to download and install packages from AUR. [image] Arch Devs Scramble as 400 AUR Pac…

Edit: according to some other thing (some GitHub script) it seems to be 1577 as of right now Link from Garuda Forum member… [eosblu@machina Desktop]$ bash ./maltest2.sh Checking for infected AUR packages (1595 total)... Clean: None of the known infected packages were installed within 2 days of …

[image] 1093i3511: https://github.com/lenucksi/aur-malware-check this test came up NO INFECTION will try the Garuda one nexr

Malicious AUR packages

General system Newbie

cactux June 12, 2026, 7:41pm 111

Earlier today, similar script originating from a moderator on Cachy’s Forum: