Guilgo Blog

Notes from my daily work with technology.

How to Detect Compromised AUR Packages with Wazuh and Telegram on Arch Linux

Hourly checks against aur-malware-check, custom decoders, and level-12 alerts if a package from the atomic-lockfile attack is installed

Guide to detect compromised AUR packages on Arch Linux using Wazuh and Telegram: hourly aur-malware-check, custom decoders, and level-12 alerts.

Posted by David Guillermo on Sunday, June 14, 2026