@sodiboo @ifin @threatintel Made a consolidated AUR malware checker for the atomic-lockfile supply-chain attack now on GitHub.

Merges detection scripts from the gist[1] and Kidev, BrianCArnold, commonsourcecs, Kacper-Kondracki, quantenProjects, Andre Herbst, ioctl.fail, and Kusoneko into a single repo. Checks known compromised packages, scans pacman.log history, checks for systemd persistence and eBPF rootkit artifacts.

https://github.com/lenucksi/aur-malware-check

UPDATE 7/13/26: Friendly contributors added a 'download official arch hedgedoc list' and the new new bun package and I added some more convenience features.

[1] https://gist.github.com/Kidev/59bf9f5fb53ab5eee99f19a6a2fc3992

#AUR #ArchLinux #SupplyChainAttack #Malware #InfoSec #atomiclockfile