{"slug": "aur-malware-check", "name": "aur-malware-check", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 3, "warners": 0, "score": 2.749, "rising": -0.98, "first": "2026-06-12", "latest": "2026-06-20", "why": "this is the most up to date, consolidated utility to check for infection", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 0, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "this is the most up to date, consolidated utility to check for infection", "icon": true, "domain": null, "github_repo": "github.com/lenucksi/aur-malware-check", "official_url": "https://github.com/lenucksi/aur-malware-check", "pricing": "", "aliases": ["aur-malware-check"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 777805936, "item_id": 48612871, "url": "https://news.ycombinator.com/item?id=48612871", "by": "diogenes_atx", "date": "2026-06-20", "stance": "recommend", "quote": "There are automated scripts to check if the infected AUR packages are installed on your system:", "excerpt": "There are automated scripts to check if the infected AUR packages are installed on your system: https://forum.endeavouros.com/t/malicious-aur-checkup-script/80114/14 https://github.com/lenucksi/aur-malware-check", "context": "", "use_case": "detect malicious AUR packages", "switched_from": "", "story": "AURpocalypse now: a look at the recent AUR attacks"}, {"id": 776289824, "item_id": 48518114, "url": "https://news.ycombinator.com/item?id=48518114", "by": "fooqux", "date": "2026-06-13", "stance": "recommend", "quote": "I found a repo with a collection of up-to-date scripts and package lists to help check for any infections", "excerpt": "For those worried, I found a repo with a collection of up-to-date scripts and package lists to help check for any infections: https://github.com/lenucksi/aur-malware-check", "context": "", "use_case": "checking for AUR malware", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 776074368, "item_id": 48504648, "url": "https://news.ycombinator.com/item?id=48504648", "by": "keysersoze33", "date": "2026-06-12", "stance": "recommend", "quote": "this is the most up to date, consolidated utility to check for infection", "excerpt": "The (Arch) community is moving quickly to release scripts/tools. Right now, this is the most up to date, consolidated utility to check for infection: https://github.com/lenucksi/aur-malware-check Also, the aur-request mailing lists has many delete/orhan requests coming through to undo the malicous commits: https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/latest", "context": "", "use_case": "detect AUR malware infection", "switched_from": "", "story": "AUR Packages Compromised with Infostealer and Rootkit"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["detect malicious aur packages", "checking for aur malware", "detect aur malware infection"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48600593", "title": "AURpocalypse now: a look at the recent AUR attacks", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48516379", "title": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48500447", "title": "AUR Packages Compromised with Infostealer and Rootkit", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"recommend": 3}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 777805936, "item_id": 48612871, "url": "https://news.ycombinator.com/item?id=48612871", "by": "diogenes_atx", "date": "2026-06-20", "stance": "recommend", "quote": "There are automated scripts to check if the infected AUR packages are installed on your system:", "excerpt": "There are automated scripts to check if the infected AUR packages are installed on your system: https://forum.endeavouros.com/t/malicious-aur-checkup-script/80114/14 https://github.com/lenucksi/aur-malware-check", "context": "", "use_case": "detect malicious AUR packages", "switched_from": "", "story": "AURpocalypse now: a look at the recent AUR attacks"}, {"id": 776289824, "item_id": 48518114, "url": "https://news.ycombinator.com/item?id=48518114", "by": "fooqux", "date": "2026-06-13", "stance": "recommend", "quote": "I found a repo with a collection of up-to-date scripts and package lists to help check for any infections", "excerpt": "For those worried, I found a repo with a collection of up-to-date scripts and package lists to help check for any infections: https://github.com/lenucksi/aur-malware-check", "context": "", "use_case": "checking for AUR malware", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 776074368, "item_id": 48504648, "url": "https://news.ycombinator.com/item?id=48504648", "by": "keysersoze33", "date": "2026-06-12", "stance": "recommend", "quote": "this is the most up to date, consolidated utility to check for infection", "excerpt": "The (Arch) community is moving quickly to release scripts/tools. Right now, this is the most up to date, consolidated utility to check for infection: https://github.com/lenucksi/aur-malware-check Also, the aur-request mailing lists has many delete/orhan requests coming through to undo the malicous commits: https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/latest", "context": "", "use_case": "detect AUR malware infection", "switched_from": "", "story": "AUR Packages Compromised with Infostealer and Rootkit"}]}