lenucksi/aur-malware-check

Health v2 · maintenance only

Flags: no_releases young

Adoption not part of the score

2168 stars · 53 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Python CLI tool that detects compromised AUR packages from the June 2026 atomic-lockfile supply-chain attack and other historical campaigns. It scans installed packages, package caches, and system artifacts for indicators of compromise using a campaign-based configuration.

Use cases

• check if my AUR packages are infected with atomic-lockfile malware
• scan my Arch system for the June 2026 AUR supply-chain attack
• detect compromised packages in npm, bun, yarn, and pnpm caches
• audit my system for eBPF rootkit and infostealer indicators
• refresh malware campaign package lists from upstream sources
• get JSON output of malware scan results for CI/CD pipelines
• track multiple AUR malware campaigns over time

When to choose

• you use Arch Linux or an AUR helper and want to verify your system is clean
• you need a dependency-free, standard-library-only scanner you can run anywhere
• you want campaign-based detection that stays current with new attack waves
• you need machine-readable scan output for automation or CI

When to avoid

• you need real-time malware protection rather than point-in-time scanning
• you are not on Arch Linux or do not use the AUR
• you need a general-purpose antivirus rather than targeted supply-chain attack detection

Facets

cli-tool · maturity active

security vulnerability-scanning cli developer-tools security developer-tools operating-systems python cli aur supply-chain-attack malware-detection arch-linux package-manager-security infostealer rootkit command-line linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="lenucksi/aur-malware-check")