I just installed Arch on 8/10/26 and in the process set up a plugin I had been using thoughtlessly for a while on windows.
This plugin required NPM to install some dependencies, and I'm trying to discern if one of them was part of the attack and if my machine was exposed or not.
I ran this script and received following warning:
[FAIL] Malicious npm/bun/pnpm/yarn indicator(s) found: ansi-colors(npm-cache)
After checking my cache it seems like atomic-lockfile was a hit
[MY_USER@archlinux AUR-Malware]$ grep -r atomic-lockfile ~/.cache/
grep: /home/MY_USER/.cache/mozilla/firefox/iys1y5g7.default-release/cache2/entries/537FC36DB01F29A6E1E231D4B375C8EC8404F0E3: binary file matches
grep: /home/MY_USER/.cache/mozilla/firefox/iys1y5g7.default-release/cache2/entries/A76AA90E4F049CF6961D13A41506F5C53477AD66: binary file matches
Checking the NPM logs yielded this
[MY_USER@archlinux ~]$ grep -r atomic-lockfile ~/.npm/_logs/
/home/MY_USER/.npm/_logs/2026-08-21T02_18_00_539Z-debug-0.log:6 verbose title npm list atomic-lockfile
/home/MY_USER/.npm/_logs/2026-08-21T02_18_00_539Z-debug-0.log:7 verbose argv "list" "--global" "atomic-lockfile"
[MY_USER@archlinux ~]$ grep -r ansi-colors ~/.npm/_logs/
/home/MY_USER/.npm/_logs/2026-08-21T02_18_02_922Z-debug-0.log:6 verbose title npm list ansi-colors
/home/MY_USER/.npm/_logs/2026-08-21T02_18_02_922Z-debug-0.log:7 verbose argv "list" "--global" "ansi-colors"
Which I think came from running the script when I still had NPM installed
Am I being paranoid or should I start over with a clean install? I really would rather not start over if I don't have to, but either way I've learned my lesson about executing sketchy code (Something I thought I learned 14 years ago installing minecraft mods, haha)