AUR package install scriptlet fetching and running remote shell script as root
Detects instances where package managers (pacman, makepkg, yay, paru) or their children spawn a root shell that downloads and executes external scripts via curl or wget.
Splunk (SPL)
