Small read-only script to check if any of the compromised AUR package names are installed

After all the compromised-package noise I got a bit paranoid, so I wrote a small read-only script that checks your installed packages against the official Arch list of bad names. It only reads from pacman and the public list, it never changes anything.
It does two passes, so it catches both normal AUR builds (pacman -Qmq) and packages pulled in through a binary repo like Chaotic-AUR (pacman -Qq), which a foreign-only check misses.

One important caveat on false positives: it matches by package NAME only. A hit is not proof you’re compromised, just that you have a package with the same name. A lot of those are harmless name collisions, for example an official, signature-validated package that was built well before the incident. So before worrying, triage each hit:

pacman -Qi <pkg> # build date, packager, "Validated By: Signature"
pacman -Qkk <pkg> # verify files against recorded checksums

Nothing clever here. It’s a portable rewrite of the bash/fish versions going around the gist so you don’t need fish installed. Maybe it saves someone a minute. Feedback welcome.
Link: