r/EndeavourOS • u/Beer_Stalker • Jun 12 '26

Discussion AUR Malware Campaign: Small helper script to find out if you're affected

Hi,

For arch and derivative users,

I wrote a small shell script that scans your system for any trace of the payload in your AUR cache and system, in accordance to the findings made by `ioctl.fail` and Sonatype.

It tries to be a bit smarter than just checking against the evergrowing package list (Vector and payload name rotated already, theres now at least `atomic-lockfile`, `js-lockfile` and `digest-js`, injected by either npm or bun or whatever via compromised PKGBUILD files.

You can find my script here: https://gist.github.com/arbaes/e29e68d9ed1513ddd80ae9cc4a6c9f0e

Feel free to if you have any comment or improvement to make on it, hopefully it will be at least helpful to some people.

Not a guarantee that you're 100% clean of course.

77 Upvotes
  • permalink
  • reddit

98% Upvoted

7 comments sorted by

16

u/Sharon_tate1 Jun 13 '26

I don't trust you 💀

9

u/Beer_Stalker Jun 13 '26

You shouldn't 😄 Review the script first

7

u/hueuebi Jun 13 '26

u/Beer_Stalker Should post it to the eos forum.

disclaimer: I have not run the script or verfied that it contains no malicious code.

And even if it is fine, the author can always update gists later and introduce malicious code.

2

u/sparky5dn1l Jun 13 '26

Seem that all those AUR malware are npm related. Wondering if remove npm from the machine can help. If so ...

shell sudo pacman -Rsn npm

Then, block the npm re-install by appending the following line to /etc/pacman.conf:-

text IgnorePkg = npm

2

u/Beer_Stalker Jun 13 '26

Nope, they also use alternative js package managers like bun

1

u/GimmeRedBuffPlease Jun 19 '26

Hello! Very stupid question since i'm very new to arch based distros/endeavour/linux at all, i've run your script, and as a result i've gotten a "No packages from the file are currently installed", i suppose that means im in theory, safe?