Don’t patronize me, alright! Move on and get on with your own life, Regular!
To be honest I agree with @milkytwix you have been gloating about this quite enough.
What I said above goes for you too.
If you or anyone thinks I am breaking any rules of the forum, flag me!
But don’t you or anyone put yourselves in a position to patronize me. Get it?
If you don’t want to be patrionized why are you trying to patronize me I wonder.
One of the members over at Garuda posted a script to check for infected packages…
[eosblu@machina Desktop]$ ./maltest.sh
Checking for infected AUR packages (494 total)...
Clean: None of the known infected packages were installed within 48 hours of the campaign.
Guys, don’t bury actual meaningful contributions and shared information about the actual situation with random noise. Be reasonable.
The link to the script to check for malicious packages in the AUR that I’ve posted early originated from the arch linux discord channel, in case you didn’t trust an private github account that may seem arbitrary and not actually affiliated to the arch dev team directly, which is actually an concern that might raise some eyebrows. I guess that it will be updated in case there are new findings. At least the latest commit is only a few hours old.
Earlier today, similar script originating from a moderator on Cachy’s Forum:
If I understand correctly it’s over 900 now
(New Wave of malicious packages?)
Edit: according to some other thing (some GitHub script) it seems to be 1577 as of right now
Edit: according to some other thing (some GitHub script) it seems to be 1577 as of right now
Link from Garuda Forum member…
[eosblu@machina Desktop]$ bash ./maltest2.sh
Checking for infected AUR packages (1595 total)...
Clean: None of the known infected packages were installed within 2 days of the campaign.
this test came up NO INFECTION
will try the Garuda one nexr
I couldn’t find a link in that thread anywhere for this maltest.sh file. will read thread again
This link is the one that is updating the list, I just renamed the script.
The number added as of now is 1,606.
thank you kindly
edit:
$ bash <(curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh)
Checking for infected AUR packages (1595 total)...
Clean: None of the known infected packages were installed within 2 days of the campaign.
this one judged me clean in like 1/100th of a second—not a scan whatsoever; just a date check I guess
better start counting AUR packages, that aren’t infected 
This actually seems like a solid use case for AI. If human moderators can’t manually review every package build, an AI system could at least scan for suspicious patterns like unexpected sed, awk, or in this case NPM usage and flag them for human approval. And with the recent DDoS issues, they might also want to consider a P2P approach.
WHAT??? And not do my at least twice daily yay? Heresy!
In all truth, I do updates every couple days, but I only have about a few items from the AUR that aren’t in the repository.
did some independent reading this aft:
"The payload targets SSH keys, GitHub tokens, npm credentials, Docker and Podman auth, HashiCorp Vault tokens, browser session data, Slack, Discord, Microsoft Teams, Telegram, VPN config files, and shell histories. It also enumerates Chromium-family browser profiles – reading SQLite cookie databases and LevelDB local storage and queries Slack, Teams, Discord, GitHub, and OpenAI/ChatGPT APIs directly with any stolen tokens or cookies.
This is a credential vacuum aimed squarely at developers. Your AWS keys in .env, your GitHub PAT in ~/.gitconfig, your SSH private key for that production server – all of it in scope."
Pay close attention to the second-to-last sentence here ^^.
Bad guys had a very specific user in mind. Who would want that?
My alias for updating is the following…
alias up='yay -Pw && yay -Syyu && flatpak update && flatpak uninstall --unused'
The -Pw shows me any Arch news I have not seen. Which came in handy just now…
─❯ up
2026-06-12 Active AUR malicious packages incident
We are currently experiencing a high volume of malicious package adoptions and updates in the Arch User Repository.
We are actively working to track down existing malicious commits and attempting to prevent additional malicious commits from being pushed.
While this is happening, and while we work to create a more permanent solution, users may see issues with the following:
Creating new accounts on the AUR
Pushing package updates
Adopting or creating new packages
We continue to encourage all users of AUR packages to review all PKGBUILD and install script changes when updating, especially during this time.
If you notice suspicious commits to a package that you use, please reach out to Arch staff via the aur-general mailing list with more information.
[sudo] password for wombat: