Arch Linux

0xd06f00d

Member

Registered: 2026-08-21

Posts: 1

Did I get pwnd by NPM?

I just installed Arch on 8/10/26 and in the process set up a plugin I had been using thoughtlessly for a while on windows.

This plugin required NPM to install some dependencies, and I'm trying to discern if one of them was part of the attack and if my machine was exposed or not.

I ran this script and received following warning:

[FAIL] Malicious npm/bun/pnpm/yarn indicator(s) found: ansi-colors(npm-cache)

After checking my cache it seems like atomic-lockfile showed up in firefox

[MY_USER@archlinux AUR-Malware]$ grep -r atomic-lockfile ~/.cache/
grep: /home/MY_USER/.cache/mozilla/firefox/iys1y5g7.default-release/cache2/entries/537FC36DB01F29A6E1E231D4B375C8EC8404F0E3: binary file matches
grep: /home/MY_USER/.cache/mozilla/firefox/iys1y5g7.default-release/cache2/entries/A76AA90E4F049CF6961D13A41506F5C53477AD66: binary file matches

Checking the NPM logs yielded this

[MY_USER@archlinux ~]$ grep -r atomic-lockfile ~/.npm/_logs/
/home/MY_USER/.npm/_logs/2026-08-21T02_18_00_539Z-debug-0.log:6 verbose title npm list atomic-lockfile
/home/MY_USER/.npm/_logs/2026-08-21T02_18_00_539Z-debug-0.log:7 verbose argv "list" "--global" "atomic-lockfile"
[MY_USER@archlinux ~]$ grep -r ansi-colors ~/.npm/_logs/
/home/MY_USER/.npm/_logs/2026-08-21T02_18_02_922Z-debug-0.log:6 verbose title npm list ansi-colors
/home/MY_USER/.npm/_logs/2026-08-21T02_18_02_922Z-debug-0.log:7 verbose argv "list" "--global" "ansi-colors"

Which I think came from running the script when I still had NPM installed

Am I being paranoid or should I start over with a clean install? I really would rather not start over if I don't have to, but either way I've learned my lesson about executing sketchy code (Something I thought I learned 14 years ago installing minecraft mods, haha)

basicallyamnesic

Member

Registered: 2026-06-06

Posts: 7

Website

Re: Did I get pwnd by NPM?

If atomic-lockfile is on your system, most likely your machine is infected, I'm not entirely sure about ansi-colors as a few sources I've checked gave conflicting results, but to be safe either try your best to purge all of lockfile off your system, or if you wanna go nuclear, a fresh install. Take this with a grain of salt though as I'm relatively new to Linux myself, but from what I understand atomic is 100% malicious.

---

A new chrome tabs takes more RAM than an arch forum tab, isn't that fun?

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,861

Re: Did I get pwnd by NPM?

There's an awful lot of those scripts around, many AI generated - who knows what they do (in doubt malicious shit)
In this case it looks (grep -q so you can't know *where* it finds stuff) some paths:
https://github.com/nightdevil00/AUR-Mal … ew.sh#L544
=> figure which one actually triggers…

zless /home/MY_USER/.cache/mozilla/firefox/iys1y5g7.default-release/cache2/entries/537FC36DB01F29A6E1E231D4B375C8EC8404F0E3

You probably at some point searched for those?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc