Mellow
August 2, 2026, 6:15am
27
Hard to give a definite answer here because there are so many on this forum alone… Many wrote scripts to check if you were affected when like the first wave of attacks happened, here are some threads
From CachyOS Moderator cscs
TL;DR
Here’s what I got…
─❯ curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | bash
Checking for infected AUR packages (480 total)...
Clean: None of the known infected packages were installed within 48 hours of the campaign.
─❯
Hi fellow EndeavorOS users,
I orginally posted on Reddit and was advised to post it here too so here I am
I wrote a small shell script that scans your system for any trace of the payload in your AUR cache and system, in accordance to the findings made by `ioctl.fail` and Sonatype.
It tries to be a bit smarter than just checking against the evergrowing package list (Vector and payload name rotated already, there’s now at least `atomic-lockfile`, `js-lockfile` and `digest-js`, injected by eithe…
This project is still in beta, but probably more interesting for all the things it can check
Arch Linux security canary — layered AUR supply-chain scanner with systemd, eBPF, and kmod auditing.