From the aur-general analysis. (1) Package inventory: pacman -Qm for foreign packages whose names are near-misses of yay/paru, or whose packager is marchos1as. (2) Install-time network: look in proxy or DNS logs for requests to web.archive.org wrapping gitflic.ru URLs, or to gitflic.ru/project/hellscripter, around package install times in /var/log/pacman.log. (3) Scriptlet review: grep cached PKGBUILD .install files for top-level curl/wget piped to sh/bash outside function bodies. (4) Any hit means root code ran: rebuild the machine and rotate credentials stored on it.