check AUR packages on system

testpkg.sh

#!/bin/bash
#
# aur_affected_check.sh
# Checks the specific aur-general mailing list post for affected packages
# and sees if any are installed locally + basic exploit indicators.
#
# Usage: ./aur_affected_check.sh
# Run as your normal user (it will use sudo only where needed for pacman -Qi).

set -euo pipefail

URL="https://gist.githubusercontent.com/Sid127/ec275e1d210e4b3d0d03583d2a15be1a/raw/409f6facdcebdb307a9d63a480ca43e438a711eb/affected-packages.txt"

echo "=== Fetching affected packages from the mailing list ==="
echo "URL: $URL"

# Fetch page and extract the exact block you described
block=$(curl -sL "$URL" || true)

if [[ -z "$block" ]]; then
    echo "ERROR: Could not extract the package list block. The page structure may have changed."
    exit 1
fi

# Extract package names (one per line in the email, typical AUR naming)
affected_packages=$(echo "$block" | \
    awk 'NF == 1 && /^[a-z0-9][a-z0-9._+-]*[a-z0-9]$/' | \
    sort -u)

count=$(echo "$affected_packages" | wc -l)
echo "Extracted $count affected package names."

if [[ $count -eq 0 ]]; then
    echo "No packages extracted. Exiting."
    exit 1
fi

echo
echo "=== Checking locally installed foreign packages (pacman -Qqm) ==="

local_packages=$(pacman -Qqm | awk '{print $1}' | sort -u)

# Find intersection
common=$(comm -12 <(echo "$affected_packages") <(echo "$local_packages"))

if [[ -z "$common" ]]; then
    echo "✅ No affected packages from this list are currently installed."
    exit 0
fi

echo "⚠️  Found the following affected packages installed:"
echo "$common" | sed 's/^/  - /'
echo

echo "=== Detailed check for each affected package ==="
echo "Look especially at 'Install Date' — anything on/after 2026-06-11 is highly suspicious."
echo

for pkg in $common; do
    echo "────────────────────────────────────────────────────────"
    echo "Package: $pkg"
    pacman -Qi "$pkg" 2>/dev/null | grep -E '^(Name|Version|Install Date|Build Date|Install Reason)' || echo "  (Could not query package info)"
    echo

    # Check build caches for the known malicious strings (atomic-lockfile / js-digest)
    echo "  Checking common AUR helper caches for malicious npm/bun strings..."
    grep -r --include="PKGBUILD" --include=".SRCINFO" \
        -E 'atomic-lockfile|js-digest' \
        ~/.cache/{yay,paru,makepkg}* 2>/dev/null | head -5 || echo "    No matches in common caches."

    echo
done

echo "────────────────────────────────────────────────────────"
echo
echo "=== Additional quick exploit artifact scan ==="
echo "Searching for the 'deps' ELF binary (the credential stealer payload)..."

find ~ /tmp /var/tmp -name deps -type f 2>/dev/null | while read -r f; do
    if file "$f" | grep -q ELF; then
        echo "  ⚠️  Possible malicious 'deps' binary found: $f"
        ls -l "$f"
    fi
done || echo "  No obvious 'deps' binaries found in home/tmp."

echo
echo "=== Recommendations if any packages were flagged ==="
echo "1. If Install Date ≥ 2026-06-11 → treat as compromised."
echo "2. Remove the package(s): sudo pacman -Rns <package>"
echo "3. Rotate ALL credentials (SSH keys, browser passwords, GitHub/GitLab tokens, etc.)."
echo "4. Check for suspicious systemd units:"
echo "   find /etc/systemd/system ~/.config/systemd/user -newermt '2026-06-09' 2>/dev/null"
echo "5. Consider a full system audit or reinstall if you built many AUR packages recently."
echo
echo "This script is a helper based on the mailing list post you linked."
echo "The list may not be 100% complete — the full thread and community gists have more entries."
echo "Done."