It took Arch ~19 years just to get archinstall.

Something tells me there won't be a script.

CachyOS community seems to have a detection script, I have not vetted this run at your own discretion.

https://discuss.cachyos.org/t/aur-compromised-400-packages-affected-20260611/31040

Here's a script:

https://gist.github.com/Kidev/59bf9f5fb53ab5eee99f19a6a2fc3992

You could probably find it on aur lmao

how many aur packages do you have? Most people i know have like AT MOST 20 or so packages from the aur. Which takes less then 2 mins to manually check against the list.

It's at the bottom of the doc:

echo "Checking for infected AUR packages (${#INFECTED_PKGS[@]} total)..."
echo

found=()
for pkg in "${INFECTED_PKGS[@]}"; do
    if pacman -Qi "$pkg" &>/dev/null; then
        found+=("$pkg")
    fi
done

if [[ ${#found[@]} -eq 0 ]]; then
    echo "Clean: none of the known infected packages are installed."
else
    echo "WARNING: ${#found[@]} infected package(s) found:"
    for pkg in "${found[@]}"; do
        echo "  - $pkg"
    done
fi

Not sure why it uses -Qi instead of -Qm since there's no point in scanning pacman packages, but I'm no expert

I haven't used kate but does it not have some sort of easy search?

ex. pacman -Qm to list AUR packages; should display the 3/4 pkgs you have installed. Then just search in kate for those 3/4 results?

Alternatively cat & grep in the terminal is pretty straight forward.

That is if it's 3/4 pkgs that are from AUR, but if someone has hundreds installed that is a bigger issue on its own.

Damn how long is the list when you

pacman -Qm

comm -1 -2 <(pacman -Qqm | sort) <(curl -s https://md.archlinux.org/s/SxbqukK6IA | sort)

Yeah, Python has been a massive vulnerability for a long while. And the AUR has similar issues. This is only getting widespread coverage now. But it's always been a risk.

Well, those are mostly extension libraries, stuff "normally" installed using pip. Arch is kind of unique that they encourage using system aur over pip, npm and other package managers. While it is a big radius, none of the python packages stick out to me, but maybe I just haven't encountered the popular ones.

Arch usually doesn't re-package Python packages that aren't needed for something else, meaning they end up in the AUR. I maintain several there, and when I stop using them I abandon them. I wouldn't be surprised if some of the ones I used to maintain are on the list