AUR-Malware-2026.06-Check

Comprehensive detection tool for the June 11, 2026 AUR supply-chain attack involving the deps credential-stealing malware.

Based on the analysis at ioctl.fail and the official Arch Linux infected packages list. Script design inspired by lenucksi/aur-malware-check.

---

What it does

Two-phase scan of your Arch Linux system:

Phase 1: Known infected packages Fetches from 3 sources on every run, merges and deduplicates into a single list. Falls back to an embedded list of ~493 packages if all remote sources are unavailable. For each match it reports:

• Local version vs current AUR version
• Install date and whether it falls in the attack window (June 9–12, 2026)
• Whether the AUR package is marked out-of-date

Phase 2: Deep malware scan

Scans the entire system for indicators of the deps malware, regardless of package name:

#	Check	What it looks for
2.1	Malware binary	deps file matching SHA256 6144d433… or MD5 42b59fdb…
2.2	npm package	atomic-lockfile@1.4.2 in npm cache or installed
2.3	Persistence	systemd services with Restart=always + RestartSec=30 in /var/lib/ or ~/.config/systemd/user/
2.4	eBPF rootkit	Pinned maps hidden_pids, hidden_names, hidden_inodes in /sys/fs/bpf/
2.5	Network C2	Active connections to temp.sh or the onion C2 host
2.6	Credential theft	Suspicious entries in SSH known_hosts and shell histories
2.7	Staging	Recently modified /usr/bin/monero-wallet-gui
2.8	Build caches	npm preinstall hooks pointing to deps in yay/paru caches

Phase 3: Optional deep checks (--full)

Enabled with the --full flag. Adds:

#	Check	What it looks for
3.1	pacman logs	Historical installs of infected packages (catches packages installed during the attack window then removed)
3.2	bun cache	Wave 2 packages (js-digest) in bun cache
3.3	npm cache (full)	All malicious packages (atomic-lockfile, lockfile-js, js-digest) in npm cache and global node_modules

---

Install

curl -sSf https://raw.githubusercontent.com/A1RM4X/AUR-Malware-2026.06-Check/main/install.sh | bash

Or manually:

git clone https://github.com/A1RM4X/AUR-Malware-2026.06-Check.git
cd AUR-Malware-2026.06-Check
bash install.sh

The installer verifies the SHA256 before copying it to /usr/local/bin/ (or ~/.local/bin/ if not root).

Run without install (advanced users)

Download and run the script directly. This skips the installer's integrity checks — verify the SHA256 yourself first:

curl -sSf https://raw.githubusercontent.com/A1RM4X/AUR-Malware-2026.06-Check/main/check-aur-vuln.sh -o /tmp/check-aur-vuln.sh && sha256sum /tmp/check-aur-vuln.sh && bash /tmp/check-aur-vuln.sh --full

Warning: Only run this if you have verified the SHA256 matches cb9f67200b9b38637e658c925cee8e7ab2d2d1271f2a6e53388ae9ac6dd9e781. Never pipe unverified scripts directly into bash.

Usage

check-aur-vuln

With --full (also scans pacman logs for historical installs, checks bun/npm cache for Wave 2 packages):

check-aur-vuln --full

With --paranoid (scans all filesystems including /mnt, /media, /proc, /dev, /run):

check-aur-vuln --paranoid

Both combined:

check-aur-vuln --full --paranoid

Show help:

check-aur-vuln --help

Uninstall

curl -sSf https://raw.githubusercontent.com/A1RM4X/AUR-Malware-2026.06-Check/main/uninstall.sh | bash

Or manually remove:

rm -f /usr/local/bin/check-aur-vuln.sh
# or
rm -f ~/.local/bin/check-aur-vuln.sh

Verify integrity

sha256sum -c SHA256SUMS

Expected: cb9f67200b9b38637e658c925cee8e7ab2d2d1271f2a6e53388ae9ac6dd9e781

Requirements

• Arch Linux (pacman)
• curl, jq, sha256sum, ss (from iproute2)
• Internet access (queries AUR API)

License

MIT — see LICENSE.

Sources

• ioctl.fail — Preliminary analysis of AUR malware
• Arch Linux — Infected packages list
• lenucksi/aur-malware-check — Script design inspiration
• Arch Linux AUR-General mailing list