Post

same! shake

I use malware btw

Would be neat if the list was curled from an online curated list in case new ones are found.

Ran the script, said i had no infect packages. Can i run a "yay -Syu" without risk ?

yeah i'd say so, either that or like apt

AUR is mostly source based. Both source based and binary PKGBUILDs were affected.

But the malware was not in the packages but in the build scripts, the PKGBUILD, whose source are open.

Good post about this sorta topic here ulveon.net/p/2025-12-03...

I’d like to see a list of known compromised packages, personally.

updated and quicker checker script here, as for me clean as a whistle... cscs.pastes.sh/aurvulntest2...

Glad i’m still on Debian ATM damn

lists.archlinux.org/archives/lis...

What!

The question is how does Arch replace the compromised packages in the AUR with "clean" packages? Is there a complete listing of compromised versions?

I don't know if this is related but in a lot of case, the package are not managed by the official maintainers of the software. Like, I saw someone maintaining a thousand AUR package, this is completely stupid

Now the famous i use arch is a cry of despair

So far my system is unaffected but as more and more get revealed I'll have to double check

I don't use the AUR on CachyOS but even if I did I would still use the same cautions and have the same mentality that I used to have on Windows, which is always assume that there's malware everywhere, ratio wise the risk is still very low on AUR compared to the general Windows population

Thanks for the heads up. That’s not that many packages luckily.

runescape launcher was one of them lmao

“Selective upgrades?? Noo, out here we upgrade everything at once!” I know Arch users must be smarter than me as a new Cachy user but I do not understand this mentality at all.

I recommend using paru, as it shows PKGBUILD contents before installing/updating packages. idk if you can configure yay to do that. but personally i will try to manually install & update packages using `makepkg -si` and check every line of package before that :)

Discussion and tracking of packages here lists.archlinux.org/archives/lis...

Hate that