aur-malware-check - Detection tools for the June 2026 atomic-lockfile

项目说明

AUR Malware Check — June 2026 Campaign & Cross-Campaign Detection

Detection and analysis tools for the atomic-lockfile supply-chain attack on
the Arch User Repository (AUR), generalized to a campaign-based architecture
that handles multiple concurrent and historical attack waves (CHAOS RAT 2025,
Russian spam packages, and future campaigns declared via campaigns.json).

This is a collection of all the scattered resources, especially the ones in the detection scripts Gist - they made this, I just collected this to a repo so I have it all in one place and possibly people could put up PR's instead of Gist links across multiple posts. Certainly see the source section for details on the sources!

> [!TIP]
> Questions, support, or general discussion? Head over to
> Discussions.
> Issues are reserved for bug reports and feature requests only.

> [!NOTE]
> This project is Python-first. The detection tool is the aur_check
> package (Python 3.14+, standard library only, typed, tested). The original
> bash scripts have been removed; their behaviour is fully covered by the
> Python implementation. See the source section for credits.

> Aur-infected 06/2026 campaign 1600+ AUR packages compromised by attackers who injected npm install atomic-lockfile, bun install js-digest, or lockfile-js into PKGBUILD/install files. Two attack waves:
> 1. atomic-lockfile / lockfile-js (npm) — accounts krisztinavarga, franziskaweber, tobiaswesterburg, ellenmyklebust; arojas (impersonated legitimate maintainer — see Impersonation Clarification)
> 2. js-digest (bun) — accounts custodiatovar,
>
> Both deliver an infostealer and eBPF rootkit targeting de credentials, browser data, and CI/CD secrets.

Quick Start

No installation, no dependencies — just Python 3.14+ and a checkout of this
repo. Run the package directly with python -m aur_check:

bash
START_DATE=2026-06-09 END_DATE=2026-06-12 python -m aur_check
PACMAN_LOG_GLOB='/var/log/pacman.log*' python -m aur_check
bash
python -m unittest discover -s aur_check/tests/ -t .

aur-malware-check/
├── README.md # This file
├── DE.md # De guide (running, testing, con)
├── pyproject.toml # Tooling config (ruff, mypy)
├── CHANGELOG.md # history
├── data/
│ ├── campaigns.json # Campaign definitions (index — paths into campaigns/)
│ └── campaigns/ # Self-contained campaign packages
│ ├── aur-infected/
│ │ ├── packages.txt # Compromised AUR packages (--refresh)
│ │ ├── packages-extra.txt # Supplementary packages (survi)
│ │ ├── npm-packages.txt # Malicious npm package names (cache checks)
│ │ ├── SOURCES.md # Annotated source references
│ │ ├── timeline.md # Incident timeline, attack , capabilities
│ │ ├── iocs.json # Structured IOCs (hashes, C2, persistence, eBPF)
│ │ ├── iocs.txt # Indicators of Compromise (prose)
│ │ └── accounts.json # Attacker accounts (tracking status)
│ ├── chaos-rat/
│ │ ├── packages.txt # CHAOS RAT packages
│ │ ├── SOURCES.md # Annotated source references
│ │ ├── iocs.json # {} — no known IOCs
│ │ └── accounts.json # {} — no known accounts
│ └── russian-spam/
│ ├── packages.txt # Russian spam packages
│ ├── SOURCES.md # Annotated source references
│ ├── iocs.json # {} — no known IOCs
│ └── accounts.json # {} — no known accounts
├── aur_check/ # Python package (the detection tool)
│ ├── __main__.py # CLI entry point (python -m aur_check)
│ ├── campaign.py # CampaignConfig dataclass, load/refresh/print helpers
│ ├── constants.py # ExitCode enum, env , defaults, thresholds, paths
│ ├── merger.py # List fetching/merging (HedgeDoc + custom lists)
│ ├── models.py # Dataclasses: PackageMatch, ScanResult, etc.
│ ├── log_utils.py # Pacman log parsing, compressed file support
│ ├── scanners/ # AurScanner split into focused modules
│ │ ├── __init__.py # AurScanner class + monkey-patched attachments
│ │ ├── package.py # check_current(), check_logs()
│ │ ├── system.py # check_systemd(), check_ebpf(), check_ioc_files()
│ │ └── cache.py # check_npm/bun/yarn/pnpm_cache()
│ └── tests/ # unittest suite
└── SOURCES.md # Index of per-campaign source references + tooling history
``

Data files: what's scanned

| File | Campaign | Consumed by scanner? | How it's kept up to date |
|------|----------|----------------------|--------------------------|
| data/campaigns.json | — (index) | ✅ Declares campaigns, their lists, windows, refresh URLs, sources | --refresh-campaigns fetches from upstream; static in repo as fallback |
| data/campaigns/aur-infected/packages.txt | aur-infected | ✅ AUR package checks | --refresh fetches the official HedgeDoc list (aur-infected campaign example) |
| data/campaigns/aur-infected/packages-extra.txt | aur-infected | ✅ AUR package checks | Supplementary list, survives --refresh |
| data/campaigns/aur-infected/npm-packages.txt | aur-infected (as npm_lists) | ✅ npm/bun/yarn/pnpm cache checks | Hand-curated — no machine-readable feed exists for this campaign (see below) |
| data/campaigns/aur-infected/iocs.json | aur-infected | ❌ documentary | Structured extraction from iocs.txt on 2026-06-24 |
| data/campaigns/aur-infected/iocs.txt | aur-infected | ❌ documentary | Hand-curated, prose with extra data compared to the JSON |
| data/campaigns/aur-infected/accounts.json | aur-infected | ❌ documentary | Hand-curated |
| data/campaigns/aur-infected/SOURCES.md | aur-infected | ❌ documentary | Annotated source references per campaign |
| data/campaigns/aur-infected/timeline.md | aur-infected | ❌ documentary | Incident timeline, attack , malware capabilities |
| data/campaigns/chaos-rat/packages.txt | chaos-rat | ✅ AUR package checks (own date window) | Static — historical July 2025 campaign |
| data/campaigns/chaos-rat/SOURCES.md | chaos-rat | ❌ documentary | Annotated source references per campaign |
| data/campaigns/russian-spam/packages.txt | russian-spam | ✅ AUR package checks (no date window) | Static — maintained by hand |
| data/campaigns/russian-spam/SOURCES.md | russian-spam | ❌ documentary | Annotated source references per campaign |

> Why the npm list isn't auto-fetched: the malicious npm package names
> (atomic-lockfile, js-digest, lockfile-js, …) were pulled from npm and are
> documented only in prose on Socket.de. They are not present in
> OSV.dev or the GitHub Ad Database under these names, so there is no
> structured feed to fetch. The list is maintained by hand with pro in
> SOURCES.md §2. Re-check those sources when adding names.

Campaign Data

Per-campaign files live in data/campaigns/<id>/:

Not all files are always present, they are added if respective info is present.

| File | Content |
|---|---|
| SOURCES.md | Annotated source references (announcements, analysis, mailing list threads) |
| timeline.md | Incident timeline, attack , malware capabilities |
| iocs.json | Structured IOCs (hashes, C2, persistence, accounts) |
| iocs.txt | Prose-style IOCs for quick reference |
| accounts.json | Attacker AUR accounts with source pro |
| packages.txt | Known malicious packages for the campaign |
| packages-extra.txt | Supplementary package list (survives --refresh) |
| npm-packages.txt | Malicious npm/bun packages used as payload |

Run python -m aur_check --list-campaigns for all source URLs with dates and comments.

What to Do If Infected

1. Preserve the system: Do not power off - use forensic acquisition with trusted media
2. Rotate ALL credentials: Discord, GitHub, npm, Slack, Teams, SSH keys, Vault tokens, cloud provider keys
3. Check for persistence: systemctl list-units --type=service --state=running (check for unknown services)
4. Check for eBPF rootkit: ls -la /sys/fs/bpf/hidden_*`
5. Clean with trusted media: Boot from Arch ISO, mount filesystem, remo systemd units
6. Consider reinstallation: The rootkit makes the system untrustworthy
7. Report findings:

Acknowledgments

Thanks to Kidev,
BrianCArnold,
commonsourcecs,
Kacper-Kondracki, and
quantenProjects
for the initial detection scripts that started this project.

Thanks also to Clément Gayot (PRs #28, #29, #38, #39, #41),
psyke089 (PR #45),
Gusta (PR #30),
drbb (PR #8),
Lion Wolf (PR #7),
aconite33 (PR #37),
Rohit K. Yadav (PR #9),
1mercdev (PR #12),
Elias Oelschner (PR #25), and
Henry (PR #18),
dwaycik (PR #46)
for their contributions via pull requests.

License

Community tools - no warranty. Use at your own risk.

Star History

<a href="
<picture>
<source media="(prefers-color-scheme: dark)" srcset=" />
<source media="(prefers-color-scheme: light)" srcset=" />
<img alt="Star History Chart" src=" />
</picture>
</a>

项目信息

开发语言：Python

Star 数：2194

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Detection tools for the June 2026 atomic-lockfile AUR supply-chain attack. Consolidated from community Gists.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。