Skip to content

AUR Security Checks

Tracking AUR package security checks against known-compromised package reports.

History

Original script (deleted)

A bash script (~/.local/bin/aur-check.sh) cross-referenced installed AUR packages against a known-compromised list from CachyOS pastebin, sending a desktop notification on match.

Deleted 2026-07-31 — the source site no longer lists anything, so the check was useless.

Manual check — 2026-07-31

Checked installed packages against the Arch Linux AUR-general mailing list thread: AUR Malware that still presents as of now (30 July 2026).

  • Two infection lists reported (Saren 27 pkgs, firstpick1992 41 pkgs — including bili-tools-git, brutefir, cardamum-git, caveman, deepseek-tui-git, gesso, humen-mcp-*, i915-sriov-dkms, llama.cpp-ggml, node-llama-cpp, nimf, warp-terminal-*, python-etcd3, rtv-git, telegram-desktop-futpib-git, stable-diffusion.cpp-ggml, astro-box and others)
  • Cross-checked against all installed packages (AUR + repo): no matches ✅
  • AUR maintainer (Robin Candau / Antiz) banned the account and reverted the malicious commits after both reports
  • Caveat: anyone who installed one of these while infected needs to reinstall to get the clean version

How to check

# List installed AUR packages
pacman -Qqm

# Manual cross-check against an infected list (one name per line in /tmp/infected.txt)
comm -12 <(pacman -Qqm | sort) <(sort /tmp/infected.txt)
  • [[Index]]
  • [[AUR Packages - Installed]]