The latest attack on the AUR
For anyone else like me who was OOTL, I guess that refers to this...
https://thehackernews.com/2026/06/over-400-arch-linux-aur-packages.html
If a flagged package ran, treat the host as credential-compromised. Rotate everything the stealer touches: browser sessions, SSH keys, GitHub and npm tokens, Slack, Teams and Discord sessions, Vault tokens, Docker and Podman credentials, and any cloud keys.
If the package ran as root, assume the rootkit is present and reinstall from trusted media. There is no way to trust the system otherwise.
Jeepers!