Per the CachyOS subreddit:

"As the title states, the Arch AUR has been hit by a huge malware infection campaign over the last couple of days. There's an earlier post referring to alvr. That's not the only package it's hundreds of them, many of them Aur packages average people would install like apple-music-desktop.

I don't have the full details of the scope of the malware campaign. I know it's a credential stealer so it steals ssh keys and browser login info and apparently has rootkit potential.

This was widespread and targeted orphaned packages. Aur for some reason allows other people to take over existing projects.

The bottom line is if you used the aur over the last couple of days you may have been infected and the problem with taking over orphaned packages I believe remains. I personally would not use the Aur for the foreseeable future, and ideally not at all. It's a security risk."

There is a script that you can run on your machine to detect if you have a package that is known to have been infected which you can view here. I have also linked the subreddit post here.

Just download it, make it executable and run the script with sudo and let it run, it will tell you what it found once it's complete.

https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency

https://ioctl.fail/preliminary-analysis-of-aur-malware/

Users can also run the following to check for malicious packages:

Tal: Yes. For example, I will never forget my game with GM Vasiukov on a USSR Championship. We reached a very complicated position where I was intending to sacrifice a knight. The sacrifice was not obvious; there was a large number of possible variations; but when I began to study hard and work through them, I found to my horror that nothing would come of it. Ideas piled up one after another. I would transport a subtle reply by my opponent, which worked in one case, to another situation where it would naturally prove to be quite useless. As a result my head became filled with a completely chaotic pile of all sorts of moves, and the infamous "tree of variations", from which the chess trainers recommend that you cut off the small branches, in this case spread with unbelievable rapidity.

And then suddenly, for some reason, I remembered the classic couplet by Korney Ivanović Chukovsky: "Oh, what a difficult job it was. To drag out of the marsh the hippopotamus".

I do not know from what associations the hippopotamus got into the chess board, but although the spectators were convinced that I was continuing to study the position, I, despite my humanitarian education, was trying at this time to work out: just how WOULD you drag a hippopotamus out of the marsh? I remember how jacks figured in my thoughts, as well as levers, helicopters, and even a rope ladder.

After a lengthy consideration I admitted defeat as an engineer, and thought spitefully to myself: "Well, just let it drown!" And suddenly the hippopotamus disappeared. Went right off the chessboard just as he had come on ... of his own accord! And straightaway the position did not appear to be so complicated. Now I somehow realized that it was not possible to calculate all the variations, and that the knight sacrifice was, by its very nature, purely intuitive. And since it promised an interesting game, I could not refrain from making it.

And the following day, it was with pleasure that I read in the paper how Mikhail Tal, after carefully thinking over the position for 40 minutes, made an accurately calculated piece sacrifice.