How can I tell if I have any infected AUR packages from the compromised repository?

[nicknick]

Hi friends. I just found out that 1600 packages from the AUR repository have been compromised (correct me if I’m wrong).

I assume it’s been fixed by now.

I don’t usually download much from the AUR, but I just updated and had over 320 packages to update, which seemed strange to me.

Anyway, I’d like to know if I’m safe or if it’s possible that my CachyOS might have some of these packages.

Thanks in advance.

EDIT:

I saw in a video that typing “pacman -Qm” would show me the packages in the AUR repository. This is what I get:

[Danny_Barron]

Well you know, that probably most things should start with a search and possibly read the announcements. If you had searched, you might have found:

AUR Compromised - 1500+ packages affected - 20260611

As recently discussed on the Arch Mailing list there appears to have been a large coordinated attack on the AUR some time within the last 24 hours that seems to have resulted in a rather sizable amount of packages being contaminated with malware. This is a good reminder that the AUR is open, unofficial, user-produced, content. The only secure way to use the Arch User Repository is by reviewing every PKGBUILD. While efforts are now underway to clean out any problem packages there still exists …