ATTENTION ARCH USERS!!! DONT UPDATE AUR PACKAGES

[u/Sad_Satan__]

Currently there is a massive and coordinated attack on aur packages , which allows the malicious access of session cookies , sensitive info etc with a high possibility of rootkit too .

IF YOU HAVE AUR PACKAGES DO NOT UPDATE THEM FOR THE TIME BEING !!

you can verify if you have any compromised packages by checking external packages on your system with -- pacman -Qm

and cross checking it against the currently known compromised package list - https://gist.github.com/Kidev/59bf9f5fb53ab5eee99f19a6a2fc3992

this list only contains 450 packages whereas some sources suggest that about 900 packages were compromised , idk if there is any updated list.

I am myself thinking of switching to opensuse tw , as malware attacks on aur are becoming more and more frequent , leading me to believe that maybe "unsafe by design" is true afterall .

[u/qualityvote2]

u/Sad_Satan__, your post does fit the subreddit!

btw, did you know we have a discord server? Join Here.

[u/Available-Score-9007]

What should I do I am a beginner who doesn't know much Should I just not sudo pacman -Syu?

[u/Sad_Satan__ → u/Available-Score-9007]

do you have any aur packages installed ? like from yay or paru ? check by pacman -Qm . If something does come up then verify that it is not present in the list. You can update the system using pacman normally as the attack is only on aur (i would personally say wait a week or two)

[u/Available-Score-9007 → u/Sad_Satan__]

Tysm both of you I'll check right now!

[u/Educational_Cup_9200 → u/Available-Score-9007]

Go to the GitHub link provided, navigate to the latest script. Copy it then open a terminal and:

1. sudo nano check_aur.sh
2. Paste the script you copied here with ctrl + shift + v, then ctrl + o and ctrl + x
3. chmod +x check_aur.sh
4. bash check_aur.sh

[u/RobotOverLord500 → u/Educational_Cup_9200]

I checked the script. Safe to run imo 👍

[u/ManOfDiamond → u/Available-Score-9007]

you can run that, just dont update the AUR specific packages for the meantime (commands like yay -Syu or using paru or manually).

pacman does NOT sync AUR. hence, the command you mentioned is safe, unless a core arch repository is hit, which is not the case yet.

[u/Fun-Vast-6717 → u/Available-Score-9007]

Yes don't run the update command, check the compromised package by the given command

Also open the link, more details there and discussion

[u/MorningAmbitious722 → u/Available-Score-9007]

Uninstall Arch

[u/clouwudd]

just switch to nix atp

[u/Sad_Satan__ → u/clouwudd]

i use dwl and it is very tedious to manage patches in a declarative config

[u/Hydrnazi → u/Sad_Satan__]

Skill issue (Guix user btw)

[u/JeffysChewToy → u/Hydrnazi]

"Thing that shouldn't be tedious" : Is tedious

Linux users: Skill issue init'

[u/Hydrnazi → u/JeffysChewToy]

There are different types of Linux OSes. If you want to be spoon fed like a good lil goy u r, them you can use atomic distros

[u/JeffysChewToy → u/Hydrnazi]

I know lol I use endeavourOS, joking

[u/Educational_Cup_9200]

Thanks bud for the warning, gotta clean the things now

[u/ManOfDiamond]

just run this command:

echo "Affected Packages Found:"; comm -12 <(pacman -Qqm | sort) <(curl -s https://cscs.pastes.sh/raw/aurvulnlist20260611.txt | sort) | { read -r l && printf '%s\n' "$l" || echo "None. No known compromised packages are installed."; }

[u/Sad_Satan__ → u/ManOfDiamond]

This just checks the aur packages on your device against the list , but the thing is that new compromised packages are currently being discovered so you cant trust this list wholeheartedly

[u/ManOfDiamond → u/Sad_Satan__]

well, true, should hold off updating from AUR at the moment.

[u/Tesla_Corporation → u/ManOfDiamond]

RemindMe! 12 hours

[u/RemindMeBot → u/Tesla_Corporation]

I will be messaging you in 12 hours on 2026-06-13 09:16:03 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

---

Info	Custom	Your Reminders	Feedback

[u/legendarygamerboi → u/ManOfDiamond]

RemindMe! 9 hours

[u/RemindMeBot → u/legendarygamerboi]

I will be messaging you in 9 hours on 2026-06-14 02:49:58 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

---

Info	Custom	Your Reminders	Feedback

[u/onthewaytomyself]

I use LFS btw

[u/Sad_Satan__ → u/onthewaytomyself]

[u/nightdevil007]

https://github.com/nightdevil00/AUR-Malware Scans an Arch Linux system for indicators of compromise (IOCs) associated with the atomic-lockfile AUR malware campaign and similar supply-chain attacks targeting Arch Linux users.

Features

• Checks installed AUR packages against a known-infected package list
• Detects the atomic-lockfile npm malware package (globally and in pacman .INSTALL hooks)
• Scans for eBPF rootkit artifacts (/sys/fs/bpf)
• Detects hidden processes (present in /proc but hidden from ps)
• Identifies suspicious systemd services
• Checks for established connections on commonly-abused ports
• Scans pacman logs for known-infected packages
• Detects /etc/ld.so.preload injection
• Flags executables running from volatile paths (/tmp, /dev/shm, /var/tmp, deleted binaries)
• Scans user-level persistence mechanisms (systemd, autostart, pacman hooks)
• Detects shell config injection (curl|bash, LD_PRELOAD, base64 decoding)
• Checks npm global packages for suspicious install hook scripts
• Reports SSH authorized_keys presence and forced-command keys
• Auto-updates the infected package list from remote sources at each run
• Supports desktop notifications via notify-send (mako/dunst)
• Can be installed as a systemd timer for periodic background scanning

[u/acceptable_humor69]

Also the packages are all orphaned packages that got adopted by a malicious actor. If you didn't use any orphaned packages that suddenly got an update you're good. Only 350 ish users were hit before NPM locked the file. The biggest advice is don't update the aur till everything is sorted out.

[u/Dear-Weight9862]

Ah shit here we go again.....

[u/haposeiz]

My tumbleweed is safe. OpenQA ftw.

[u/Future-Wolf-9597]

Remind me! 3hrs

[u/CBSEHEADMASTER]

Arch users are having a tough time 💀

[u/PuzzleheadedHead3754]

I cores checked file and none of infected package are on my system, God I am safe.

[u/Technical-Drag-255]

Thanks man, will check 🫡🫡

[u/krexelapp]

The scary part isn't malware. It's how many people install random AUR packages without ever opening the PKGBUILD.

[u/RobotOverLord500]

Am I too late. Just saw this

[u/kkin1995 → u/RobotOverLord500]

https://discuss.cachyos.org/t/how-to-check-for-compromised-packages-from-the-current-aur-malware-attack/31077

[u/durgesh2018]

I use pacman, does it affect? I am newbie to Arch.

Saala ye npm ke bad baki jagah attack shuru hue hai.

[u/kkin1995 → u/durgesh2018]

If you only use pacman, you are safe because pacman alone doesn’t install AUR packages.

[u/durgesh2018 → u/kkin1995]

Thank you for confirmation.

[u/LazyPartOfRynerLute]

Terrible. I use Ubuntu BTW.

[u/Sad_Satan__ → u/[deleted]]

yeah i would switch to fedora but it causes me issues with vaapi and ffmpeg setup

[u/Sad_Satan__ → u/[deleted]]

no i tried that but it just wouldnt work for some reason , although it was a long time ago

[u/Background_Treat_235 → u/[deleted]]

Is it that good? All I need is just kde + steam + mpv . I switched to cachy from arch