A Python 3.14+ CLI tool (stdlib only) for detecting malware in packages from the Arch User Repository. It scans currently installed AUR packages, historical pacman logs, systemd services, eBPF rootkit artifacts, and npm/bun/yarn/pnpm caches against configurable campaign-based threat lists (e.g., the June 2026 atomic-lockfile attack, CHAOS RAT 2025, Russian spam campaigns). The architecture is modular: campaign configuration is data-driven (JSON), the scanner is split into focused mixin classes (PackageMixin, SystemMixin, CacheMixin) combined via the AurScanner class, and all results are typed dataclasses. The package runs with zero external dependencies, has comprehensive unit tests, and includes an integration layer (pacman hook + systemd timer) for continuous monitoring. The code demonstrates high craftsmanship: strict typing, defensive I/O, locale-safe date parsing, cache-efficient file scanning, and a clean exit-code scheme based on Nagios conventions.