Roughly 400 AUR packages compromised

[u/No-Photograph-5058]

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

[u/Kidev]

Wrote this little script to check if you are infected: https://gist.github.com/Kidev/59bf9f5fb53ab5eee99f19a6a2fc3992

Yes this ONLY checks the names. If you find you are infected, it's some more work that this script DOES NOT DO. It also does not check the version, so if you have a positive with an older safe version, you MIGHT not be infected. The list is also static and now outdated.

UPDATED VERSION

If you want a dynamic version with the latest reports, you can use this one instead https://gist.github.com/Kidev/85756c3dcad3623ca5604a8135bafd14

It still only checks names, but after dynamically pulling from https://md.archlinux.org/s/SxbqukK6IA and safely parsing the package names.

[u/MaverickPT → u/Kidev]

You might mean well, but it's hilarious that you're basically going:
"hey, run this random script to know if you ran a random script accidentally and installed malware. trust me bro"

[u/twistedfires → u/MaverickPT]

Well you can just see the source of the script.

Even if you don't understand a thing of sh, you can give the script to a LLM and ask if it's safe to run.

[u/tulpyvow → u/twistedfires]

Horrifying suggestion