As recently discussed on the Arch Mailing list there appears to have been a large coordinated attack on the AUR some time within the last 24 hours that seems to have resulted in a rather sizable amount of packages being contaminated with malware.
This is a good reminder that the AUR is open, unofficial, user-produced, content.
The only secure way to use the Arch User Repository is by reviewing every PKGBUILD.
While efforts are now underway to clean out any problem packages there still exists the possibility that some users may have inadvertently downloaded some of these malicious sources.
Clarify
In case it needs to be stated plainly: the CachyOS repos are unaffected.
Using pacman or upgrading with it such as pacman -Syu would be safe.
This can only possibly apply to users who installed or upgraded any of the compromised packages from the AUR during the time of exploitation.
If unsure the following command will print any installed foreign packages:
pacman -Qm
If you do use foreign packages and want to check if any of them match the list of compromised packages then there are some various approaches, some of which are detailed below.
Scripted check
Out of an abundance of caution I have duplicated efforts elsewhere to have a checkup script and will update it if and as more packages are found to be affected.
You can run it remotely using the following commands.
BASH, others:
bash <(curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh)
FISH:
bash <(curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | psub)
Unscripted check
If avoiding any kind of execution during this time is preferable then a companion simple text list is available.
It can be used manually or with the following one-liners to perform a simpler comparison.
BASH, others:
echo "Affected Packages Found:"; comm -12 <(pacman -Qq | sort) <(curl -s https://cscs.pastes.sh/raw/aurvulnlist20260611.txt | sort) | { read -r l && printf '%s\n' "$l" || echo "None. No known compromised packages are installed."; }
FISH:
echo "Affected Packages Found:"; comm -12 (pacman -Qq | sort | psub) (curl -s https://cscs.pastes.sh/raw/aurvulnlist20260611.txt | sort | psub) | { read -r l && printf '%s\n' "$l" || echo "None. No known compromised packages are installed."; }
What to do if believed to be affected?
( as adapted from the original )
- To inspect: Do not power off - Do disconnect - Use forensic acquisition with trusted media
- Rotate ALL credentials: Discord, GitHub, npm, Slack, Teams, SSH keys, Vault tokens, cloud provider keys
- Check for persistence:
systemctl list-units --type=service --state=running(check for unknown services) - Check for eBPF rootkit:
ls -la /sys/fs/bpf/hidden_* - Clean with trusted media: Boot from Cachy or other Arch ISO, mount filesystem, remove malicious systemd units
- Consider wipe and reinstall: Any rootkit makes the system untrustworthy
- Report novel findings: Aur-general - lists.archlinux.org
