Thanks for sharing.

But, please stop using the curl command piped into a terminal pattern. Malicious actors have been abusing the fuck out of this pattern ever since the idiots at Anthropic decided that would be the official install pattern for Claude. I've been cleaning up infections based on people just blindly running shit like that constantly over the last couple months.

Folks, never run a random script from the internet, without being sure what you are actually about to run. If using AUR packages is considered risky. Random scripts being piped into a terminal ranks right up there with sticking your dick in a blender.

Ah, nice. My friend group made one as well.

I hope Arch gets this shit sorted.

There is also already this:
https://github.com/lenucksi/aur-malware-check

Ah yes, run this random shell script hosted on the internet.

And I got downvoted for suggesting that they use an ML tool like crowdstrike to scan submissions for weird things.... and for some reason people pointed out that they caused one incident of linux crashes and one incident of windows crashes last year. What if I told you that you could run a scan like that on a VM with the storage, web hosting and everything else entirely separate from said scanning VM... but no, random shell scripts into terminal GO!

Just seeing the results of a sandbox detonation should give you some level of an idea that something is bad or not bad. This kind of tooling isn't exclusive to any one entity and the results should be part of any repo for anyone to review and flag if you really want to avoid ML as a layer of defense.

You should be reviewing the PKGBUILD on anything from the AUR anyway