feat(scripts): update AUR malware checker
This commit is contained in:
@@ -30,10 +30,10 @@ android-backup-extractor
|
||||
android-docs
|
||||
android-google-play-apk-expansion
|
||||
android-google-play-licensing
|
||||
androidscreencast-bin
|
||||
android-signapk
|
||||
android-signapk-gui
|
||||
android-support-repository
|
||||
androidscreencast-bin
|
||||
annobin
|
||||
ansible-language-server
|
||||
ant-dracula-gtk-theme
|
||||
@@ -48,15 +48,18 @@ apm_planner-bin
|
||||
apothem
|
||||
apple-music-desktop
|
||||
apwal
|
||||
aquaria-ose
|
||||
ar-smileys
|
||||
arachnophilia
|
||||
arcadia
|
||||
arch-palemoon-search
|
||||
arch-update-vai
|
||||
archivemail
|
||||
archjh
|
||||
archlinux-themes-balou
|
||||
archlinux-themes-slim
|
||||
archmage
|
||||
arch-palemoon-search
|
||||
archtex-git
|
||||
arch-update-vai
|
||||
arduino-git
|
||||
argouml
|
||||
aria2fe
|
||||
@@ -64,9 +67,9 @@ ariang-allinone
|
||||
arm-linux-gnueabihf-binutils
|
||||
arm-linux-gnueabihf-glibc-headers
|
||||
arm-linux-gnueabihf-linux-api-headers
|
||||
ar-smileys
|
||||
artanis-git
|
||||
ascii-rain-git
|
||||
asciiworld-git
|
||||
astah-uml
|
||||
astro-editor-appimage
|
||||
asus-fan-dkms-git
|
||||
@@ -129,19 +132,25 @@ bouml
|
||||
bpytop-git
|
||||
bracket
|
||||
brightness-controller-git
|
||||
brother-hl3150cdw
|
||||
brother-hll6200dw
|
||||
brow6el
|
||||
brow6el-git
|
||||
brscan3
|
||||
bsnes-plus-git
|
||||
burn-cd
|
||||
c++-gtk-utils-gtk2
|
||||
caelum
|
||||
camotics
|
||||
canon-pixma-mg3000-complete-fixed
|
||||
capt-src
|
||||
capture
|
||||
cardano-node
|
||||
cartridge-cli
|
||||
castawesome
|
||||
castersoundboard-git
|
||||
cattle
|
||||
cavestory+-hb
|
||||
cb2bib
|
||||
ccase-bin
|
||||
cccc
|
||||
@@ -149,10 +158,10 @@ ccl-git
|
||||
ccminer-git
|
||||
ccsm-gtk3
|
||||
cdo
|
||||
centerim5-git
|
||||
cerbere-git
|
||||
cerebro
|
||||
cgminer
|
||||
c++-gtk-utils-gtk2
|
||||
cgvg
|
||||
charcoal
|
||||
chexquest3-wad
|
||||
@@ -162,6 +171,8 @@ chipmunk
|
||||
chisel
|
||||
chromeos-apk-git
|
||||
cinny-desktop-system-tray
|
||||
cint
|
||||
cjs-git
|
||||
clai
|
||||
clamfs
|
||||
clang15
|
||||
@@ -174,9 +185,11 @@ cmake-modules-webos-git
|
||||
cmospwd
|
||||
cmuclmtk
|
||||
cnijfilter-common
|
||||
cnijfilter-common-mg5400
|
||||
cnijfilter-ip110
|
||||
cnijfilter-mp550
|
||||
code-git
|
||||
codeclimate
|
||||
codeigniter
|
||||
codenomad-bin
|
||||
codeql-cli-bin
|
||||
@@ -186,14 +199,18 @@ colorhug-client
|
||||
colorsvn
|
||||
colorz
|
||||
compiler-rt19
|
||||
compizconfig-python
|
||||
compiz-fusion-plugins-experimental
|
||||
compiz-fusion-plugins-experimental-git
|
||||
compiz-fusion-plugins-extra
|
||||
compiz-fusion-plugins-extra-git
|
||||
compizconfig-python
|
||||
compizconfig-python-git
|
||||
complexity
|
||||
connman-ncurses
|
||||
connman-ncurses-git
|
||||
connman-ui-git
|
||||
containerd-git
|
||||
contemporary-cursors
|
||||
controllermap
|
||||
coolreader
|
||||
coolreader3-git
|
||||
@@ -202,10 +219,10 @@ cowdancer
|
||||
coyim
|
||||
cpp-netlib
|
||||
cppreference-devhelp
|
||||
cpu-monitor-extension-lxpanel-plugin
|
||||
cpufreqd
|
||||
cpuminer-multi
|
||||
cpuminer-multi-git
|
||||
cpu-monitor-extension-lxpanel-plugin
|
||||
cpuset
|
||||
craftbukkit-plugin-worldedit
|
||||
createvm
|
||||
@@ -229,8 +246,8 @@ cutefish-settings
|
||||
cutefish-statusbar
|
||||
cutefish-wallpapers
|
||||
cutemarked-git
|
||||
cvs2svn
|
||||
cvs-feature-bin
|
||||
cvs2svn
|
||||
cwiid
|
||||
cynthiune.app
|
||||
d1x-rebirth
|
||||
@@ -286,8 +303,8 @@ dvorak7min
|
||||
dyad-bin
|
||||
dynamodb
|
||||
e4rat-lite-git
|
||||
easymp3gain-qt4-bin
|
||||
easy_spice
|
||||
easymp3gain-qt4-bin
|
||||
easytag-git
|
||||
echinus-git
|
||||
echo-icon-theme-git
|
||||
@@ -302,9 +319,9 @@ efiboots-git
|
||||
eisl
|
||||
electrum-bin
|
||||
electrum-nmc
|
||||
elmerfem
|
||||
elm-format-bin
|
||||
elm-platform
|
||||
elmerfem
|
||||
emacs-color-theme
|
||||
emacs-d-mode
|
||||
emacs-ess-git
|
||||
@@ -343,9 +360,9 @@ exiftags
|
||||
exodas
|
||||
exodis
|
||||
exodud
|
||||
exodus-wallet-bin
|
||||
exoduss
|
||||
exoduswallet
|
||||
exodus-wallet-bin
|
||||
exodux
|
||||
exoduz
|
||||
exodys
|
||||
@@ -359,13 +376,13 @@ fastoggenc
|
||||
fatx
|
||||
fbctrl
|
||||
fbff-git
|
||||
fcitx5-pinyin-sougou-dict-git
|
||||
fcitx-baidupinyin
|
||||
fcitx5-pinyin-sougou-dict-git
|
||||
fengoffice
|
||||
ffdiaporama-texturemate
|
||||
ffmpeg3.4
|
||||
ffmpeg-bitrate-stats
|
||||
ffmpeg-quality-metrics
|
||||
ffmpeg3.4
|
||||
fifth
|
||||
filebot47
|
||||
findpkg-git
|
||||
@@ -380,8 +397,8 @@ flashfocus
|
||||
flatcam-git
|
||||
flexiblas
|
||||
flow
|
||||
flowblade-git
|
||||
flow-pomodoro
|
||||
flowblade-git
|
||||
flv2x264
|
||||
flynarwhal
|
||||
fmlib
|
||||
@@ -431,12 +448,12 @@ gimp-plugin-arrow
|
||||
gist-git
|
||||
gisto
|
||||
git-annex-standalone
|
||||
gitflow-avh
|
||||
git-flow-completion-git
|
||||
git-remote-hg-git
|
||||
gitflow-avh
|
||||
gitfs
|
||||
gitinspector
|
||||
gitosis-git
|
||||
git-remote-hg-git
|
||||
gitso
|
||||
gitter-bin
|
||||
gkraken
|
||||
@@ -468,8 +485,8 @@ gnome-usage-git
|
||||
gnome-xcf-thumbnailer
|
||||
gnuplot-git
|
||||
gnutls3.8.9
|
||||
gogs-git
|
||||
gog-the-witcher-2-assassins-of-kings
|
||||
gogs-git
|
||||
gohufont-powerline
|
||||
gopenvpn-git
|
||||
gopher2600
|
||||
@@ -479,34 +496,35 @@ gosh
|
||||
gpicsync
|
||||
gpshell
|
||||
gpx-viewer
|
||||
gr-osmosdr-git
|
||||
graal-bin
|
||||
graveman
|
||||
greenisland
|
||||
green-tunnel-bin
|
||||
greenisland
|
||||
greetd-wlgreet-git
|
||||
gridmgr-git
|
||||
grim-git
|
||||
gr-osmosdr-git
|
||||
grpn
|
||||
grub4dos
|
||||
grub-luks-keyfile
|
||||
grub4dos
|
||||
gsettings-desktop-schemas-git
|
||||
gtkimageview
|
||||
gtksetpwc
|
||||
gtk-theme-bsm-simple
|
||||
gtk-theme-metagrip
|
||||
gtk-theme-windows10-dark
|
||||
gtk-vnc-gtk2
|
||||
gtkimageview
|
||||
gtksetpwc
|
||||
guake-colors-solarized-git
|
||||
guile-git
|
||||
guile-reader
|
||||
guile-ssh
|
||||
guiscrcpy
|
||||
gummy
|
||||
gummy-git
|
||||
gxemul
|
||||
ha-pacemaker-git
|
||||
hackmatrix-git
|
||||
halberd
|
||||
ha-pacemaker-git
|
||||
hardcode-tray
|
||||
harminv
|
||||
harmony-wad
|
||||
@@ -514,6 +532,7 @@ haskell-asn1-data
|
||||
haskell-chart
|
||||
haskell-failure
|
||||
haskell-hscurses
|
||||
haskell-hssyck
|
||||
hattrick_organizer
|
||||
haunt
|
||||
haxe-git
|
||||
@@ -534,6 +553,7 @@ hop
|
||||
horst
|
||||
hotlinemiami
|
||||
howm-x11-git
|
||||
hp-health
|
||||
hpgcc
|
||||
hpoj
|
||||
htdig
|
||||
@@ -547,8 +567,8 @@ hydrus-git
|
||||
hypervc-qt4
|
||||
hypr-git
|
||||
i2c-ch341-dkms
|
||||
i3bar-river
|
||||
i3-gnome-git
|
||||
i3bar-river
|
||||
i3lock-fancy-dualmonitors-git
|
||||
ianny-bin
|
||||
ibc
|
||||
@@ -565,6 +585,7 @@ ikos
|
||||
imageglass
|
||||
img2djvu-git
|
||||
inadyn
|
||||
inadyn-mt
|
||||
indicator-session
|
||||
infinity-background
|
||||
infnoise-openssl-git
|
||||
@@ -587,16 +608,18 @@ jasmin
|
||||
jasp-desktop
|
||||
java-berkeleydb
|
||||
java-flexdock
|
||||
javahelp2
|
||||
java-qdox
|
||||
javahelp2
|
||||
jd-gui
|
||||
jdk-openj9-bin
|
||||
jdk11-openj9-bin
|
||||
jdk17-jetbrains-bin
|
||||
jdk8-graalvm-bin
|
||||
jdk-openj9-bin
|
||||
jetbrains-mps
|
||||
jflex
|
||||
jin
|
||||
joxi
|
||||
joy
|
||||
joycon-git
|
||||
joymouse
|
||||
jreen-git
|
||||
@@ -611,13 +634,18 @@ katrain
|
||||
kdb
|
||||
kddockwidgets-git
|
||||
kdevelop-pg-qt-git
|
||||
keep
|
||||
keepass-fr
|
||||
keepass-plugin-qualitycolumn
|
||||
keepassx2
|
||||
keeperrl-git
|
||||
kexi
|
||||
kicad-library-ab2-git
|
||||
kiconedit
|
||||
kimageformats-git
|
||||
kio_gopher
|
||||
kiss
|
||||
kmarkdownwebview
|
||||
kodi-addon-inputstream-adaptive-git
|
||||
kokua-secondlife
|
||||
kompare-git
|
||||
@@ -729,11 +757,11 @@ linux-cachyos-native-nvidia-open
|
||||
linux-cachyos-rc-native
|
||||
linux-cachyos-rc-native-headers
|
||||
linux-cachyos-rc-native-nvidia-open
|
||||
linux_logo_archcustom
|
||||
linux-manjaro-xanmod
|
||||
linux-rc
|
||||
linux-tool
|
||||
linux-xanmod-rog
|
||||
linux_logo_archcustom
|
||||
linvst
|
||||
liri-cmake-shared-git
|
||||
liri-shell-git
|
||||
@@ -755,8 +783,8 @@ lure
|
||||
lv
|
||||
lxdvdrip
|
||||
m5rcode
|
||||
machinarium
|
||||
mac-os-lion-cursors
|
||||
machinarium
|
||||
madsonic
|
||||
magicassistant-gtk
|
||||
magpie-wm
|
||||
@@ -772,9 +800,10 @@ mathsat-5
|
||||
mato-icons-git
|
||||
matrixbrandy
|
||||
maxima-git
|
||||
mcpatcher
|
||||
mcp-probe
|
||||
mbm-gpsd-pl4nkton-git
|
||||
mc-skin-modarin-debian
|
||||
mcp-probe
|
||||
mcpatcher
|
||||
me_cleaner-git
|
||||
menumaker-compiz
|
||||
mermaid-ascii-git
|
||||
@@ -827,13 +856,14 @@ movgrab
|
||||
mp3guessenc
|
||||
mpir
|
||||
mqttfx-bin
|
||||
msieve
|
||||
ms-office-online
|
||||
msieve
|
||||
multimon-ng-git
|
||||
multiwinia
|
||||
mxnet
|
||||
mysqltuner-git
|
||||
mythes-cs
|
||||
n-ninja
|
||||
n1-translator
|
||||
naemon
|
||||
naemon-livestatus
|
||||
@@ -879,7 +909,6 @@ nikola-git
|
||||
nip2
|
||||
nixnote2
|
||||
nixnote2-git
|
||||
n-ninja
|
||||
nocodb
|
||||
noctyra-dotfiles-git
|
||||
noctyra-meta-git
|
||||
@@ -896,10 +925,10 @@ notify-desktop-git
|
||||
notion-app-enhanced
|
||||
nox-bin
|
||||
nrpe
|
||||
num-utils
|
||||
numix-gtk-theme
|
||||
numix-themes-electric
|
||||
numix-themes-green
|
||||
num-utils
|
||||
nvdock-bumblebee
|
||||
nvidia-xrun-git
|
||||
nwchem
|
||||
@@ -914,18 +943,18 @@ oclint
|
||||
octave-hg
|
||||
octave-miscellaneous
|
||||
octocode
|
||||
oh-my-git
|
||||
ohcount
|
||||
ohcount-git
|
||||
oh-my-git
|
||||
olivia-git
|
||||
openav-sorcer-git
|
||||
open-axiom
|
||||
open-hexagon-git
|
||||
openav-sorcer-git
|
||||
opencode-codebase-index-bin
|
||||
opencorsairlink-git
|
||||
opendrop
|
||||
openhab2
|
||||
openhab3
|
||||
open-hexagon-git
|
||||
openms
|
||||
openmsx-catapult
|
||||
opennebula
|
||||
@@ -1001,13 +1030,13 @@ pharo-bin
|
||||
phonon-qt4
|
||||
phonon-qt5-vlc
|
||||
php-blackfire
|
||||
phpdocumentor2
|
||||
php-geoip
|
||||
php-legacy-memcache
|
||||
php-memcache
|
||||
php-openswoole-git
|
||||
phpredis-git
|
||||
php-xdiff
|
||||
phpdocumentor2
|
||||
phpredis-git
|
||||
picom-ftlabs-git
|
||||
picpuz
|
||||
pidgin-cmds
|
||||
@@ -1053,24 +1082,6 @@ pypi-cli
|
||||
pypiserver
|
||||
pypy-setuptools
|
||||
pyrescene-git
|
||||
python2-appdirs
|
||||
python2-cffi
|
||||
python2-chardet
|
||||
python2-cssselect
|
||||
python2-ctypes
|
||||
python2-fusepy
|
||||
python2-gobject
|
||||
python2-lazr-uri
|
||||
python2-mutagen
|
||||
python2-notify
|
||||
python2-packaging
|
||||
python2-paver
|
||||
python2-pyparsing
|
||||
python2-simplejson
|
||||
python2-simpleparse
|
||||
python2-stomper
|
||||
python2-twodict-git
|
||||
python2-xlib
|
||||
python-affine
|
||||
python-apt
|
||||
python-argdispatch
|
||||
@@ -1087,9 +1098,9 @@ python-cu2qu-git
|
||||
python-dataproperty
|
||||
python-dbapi-compliance
|
||||
python-dictobject
|
||||
python-dj-database-url
|
||||
python-django-modelcluster
|
||||
python-django-rest-knox
|
||||
python-dj-database-url
|
||||
python-dugong
|
||||
python-epc
|
||||
python-fastmcp-slim
|
||||
@@ -1151,6 +1162,24 @@ python-uhi
|
||||
python-uproot
|
||||
python-vector
|
||||
python-xtarfile
|
||||
python2-appdirs
|
||||
python2-cffi
|
||||
python2-chardet
|
||||
python2-cssselect
|
||||
python2-ctypes
|
||||
python2-fusepy
|
||||
python2-gobject
|
||||
python2-lazr-uri
|
||||
python2-mutagen
|
||||
python2-notify
|
||||
python2-packaging
|
||||
python2-paver
|
||||
python2-pyparsing
|
||||
python2-simplejson
|
||||
python2-simpleparse
|
||||
python2-stomper
|
||||
python2-twodict-git
|
||||
python2-xlib
|
||||
pytomtom
|
||||
pyxplot
|
||||
qbittorrent-enhanced-qt5
|
||||
@@ -1180,6 +1209,7 @@ quickswitch-i3
|
||||
qutepart-git
|
||||
qv2ray-git
|
||||
qwt-qt4
|
||||
r-dbplyr
|
||||
r2-iaito-git
|
||||
r8101-dkms
|
||||
rabbitvcs-cli
|
||||
@@ -1192,7 +1222,6 @@ rainbarf-git
|
||||
rarian
|
||||
ratox-git
|
||||
rbutil-git
|
||||
r-dbplyr
|
||||
rdm-bin
|
||||
rdup
|
||||
reactphysics3d
|
||||
@@ -1256,8 +1285,8 @@ ruby-sprockets-rails
|
||||
ruby-thread_safe
|
||||
ruby-travis
|
||||
rumor
|
||||
runescape-launcher
|
||||
run-mailcap
|
||||
runescape-launcher
|
||||
rxvt-unicode-256xresources
|
||||
sachesi-bin
|
||||
sakura-launcher-gui
|
||||
@@ -1280,12 +1309,13 @@ sddm-stellar-theme
|
||||
sdformat
|
||||
seahorse-nautilus
|
||||
selenium-server-standalone
|
||||
sentry
|
||||
sequencer64-git
|
||||
sex
|
||||
sfarkxtc
|
||||
sfnt2woff
|
||||
shadowgrounds
|
||||
shadow-tech
|
||||
shadowgrounds
|
||||
sheeplifter
|
||||
shellcheck-git
|
||||
shellinabox-git
|
||||
@@ -1299,8 +1329,8 @@ signald
|
||||
silver-searcher-git
|
||||
sixfireusb-dkms
|
||||
skanlite-git
|
||||
slime-git
|
||||
slim-unicode
|
||||
slime-git
|
||||
slipnet
|
||||
slipnet-bin
|
||||
smartsim-git
|
||||
@@ -1312,6 +1342,7 @@ snapd-git
|
||||
snis-git
|
||||
snowman-git
|
||||
snry-shell-qs
|
||||
so-synth-lv2-git
|
||||
soapyptezuka
|
||||
socnetv
|
||||
softethervpn-client-manager
|
||||
@@ -1322,7 +1353,6 @@ sonar-icon-theme
|
||||
sonixd
|
||||
sonosano
|
||||
sope2
|
||||
so-synth-lv2-git
|
||||
soundpaad-bin
|
||||
soxt
|
||||
spigot-plugin-essentials
|
||||
@@ -1394,12 +1424,12 @@ toggldesktop
|
||||
tomighty
|
||||
toolsched
|
||||
toontown-rewritten
|
||||
tor-messenger-bin
|
||||
tora
|
||||
torch7-cutorch-git
|
||||
torch7-git
|
||||
torch7-image-git
|
||||
torch7-trepl-git
|
||||
tor-messenger-bin
|
||||
tortoisehg-hg
|
||||
touchhle
|
||||
touchosc-bin
|
||||
@@ -1415,7 +1445,6 @@ trytond
|
||||
tsm
|
||||
tsocks-tools
|
||||
ttcp
|
||||
ttf2eot
|
||||
ttf-consolas-powerline
|
||||
ttf-dejavu-emojiless
|
||||
ttf-dejavu-sans-mono-powerline-git
|
||||
@@ -1426,6 +1455,7 @@ ttf-material-design-icons-git
|
||||
ttf-mutant-emoji
|
||||
ttf-pizzadude-bullets
|
||||
ttf-roboto-fontconfig
|
||||
ttf2eot
|
||||
tunacode-cli
|
||||
tup-git
|
||||
tuxboot-git
|
||||
@@ -1446,6 +1476,7 @@ upower-nocritical
|
||||
urbanbrawl-wad
|
||||
urho3d
|
||||
urjtag-git
|
||||
usbmount
|
||||
vapoursynth-preview-git
|
||||
vbam-git
|
||||
vcp-git
|
||||
@@ -1460,9 +1491,11 @@ vidcutter
|
||||
video-contact-sheet
|
||||
viennacl
|
||||
vim-clang-complete-git
|
||||
vim-delimitmate
|
||||
vim-easymotion
|
||||
vim-fortran
|
||||
vim-gitgutter
|
||||
vim-hexman
|
||||
vim-indent-object
|
||||
vim-lighttpd
|
||||
vim-live-latex-preview
|
||||
@@ -1470,6 +1503,8 @@ vim-manpageview
|
||||
vim-molokai
|
||||
vim-molokai-git
|
||||
vim-octave
|
||||
vim-omlet
|
||||
vim-pandoc-syntax-git
|
||||
vim-pathogen-git
|
||||
vim-perl-support
|
||||
vim-pythonhelper
|
||||
@@ -1490,17 +1525,18 @@ vuze-extreme-mod
|
||||
vuze-plugin-countrylocator
|
||||
vuze-plugin-mldht
|
||||
wallpaper-generator-next
|
||||
wally
|
||||
watchman
|
||||
watsup
|
||||
wavbreaker
|
||||
wayland-static
|
||||
wcalc
|
||||
wds
|
||||
we-layerd-git
|
||||
webilder-gtk-patched
|
||||
webui-aria2-git
|
||||
wechat-devtools
|
||||
weex
|
||||
we-layerd-git
|
||||
wemux-git
|
||||
wesnoth-git
|
||||
whatsie-git
|
||||
@@ -1510,11 +1546,13 @@ whitebox
|
||||
whysynth
|
||||
windowmaker-git
|
||||
windows2usb-git
|
||||
wineasio-git
|
||||
wine-nine
|
||||
wineasio-git
|
||||
wings2
|
||||
wire-desktop
|
||||
wiringpi-git
|
||||
wlroots-nvidia
|
||||
wmtop
|
||||
word-snatchers-cli
|
||||
workbench
|
||||
workbuddy-bin
|
||||
@@ -1529,6 +1567,7 @@ xapian-omega
|
||||
xarchiver-assume-name
|
||||
xcursor-gt3
|
||||
xerox-phaser-6000-6010
|
||||
xevdevserver
|
||||
xf86-input-cmt
|
||||
xf86-input-joystick
|
||||
xf86-input-mtrack
|
||||
@@ -1557,6 +1596,7 @@ yofrankie
|
||||
yokadi
|
||||
yt6801-dkms
|
||||
yy
|
||||
z-push
|
||||
zafiro-icon-theme
|
||||
zaproxy-weekly
|
||||
zathura-gruvbox-git
|
||||
@@ -1574,6 +1614,6 @@ zing-17-bin
|
||||
zing-21-bin
|
||||
zing-8-bin
|
||||
zinnia-python
|
||||
z-push
|
||||
zrythm-git
|
||||
zsdx
|
||||
zsdx
|
||||
zxtune-git
|
||||
|
||||
@@ -8,12 +8,12 @@ set -uo pipefail
|
||||
# accounts. The live package list URL below is the working list linked from that
|
||||
# thread.
|
||||
#
|
||||
# Reports around this wave included unexpected npm payload paths and indicators
|
||||
# such as atomic-lockfile and tdatasnap, with TelegramDesktop/tdata mentioned as
|
||||
# a possible data theft target. The script checks installed foreign packages,
|
||||
# pacman history, AUR helper caches, and those payload indicators. Keep
|
||||
# check-aur-malware.packages next to this script as a bundled fallback because
|
||||
# the live HedgeDoc note may move or disappear.
|
||||
# Reports around this wave included unexpected npm and bun package installation,
|
||||
# malicious package names such as atomic-lockfile, lockfile-js, and js-digest,
|
||||
# and TelegramDesktop/tdata as a possible data theft target. The script checks
|
||||
# installed foreign packages, pacman history, AUR helper caches, and those
|
||||
# payload indicators. Keep check-aur-malware.packages next to this script as a
|
||||
# bundled fallback because the live HedgeDoc note may move or disappear.
|
||||
#
|
||||
# Sources:
|
||||
# - Arch AUR report thread: https://lists.archlinux.org/archives/list/aur-general%40lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
|
||||
@@ -31,6 +31,8 @@ script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
|
||||
bundled_list="${script_dir}/check-aur-malware.packages"
|
||||
cache_dir="${XDG_CACHE_HOME:-${HOME:-}/.cache}/aur-malware-check"
|
||||
cached_list="${cache_dir}/package-list.txt"
|
||||
payload_pattern='atomic-lockfile|lockfile-js|js-digest|tdatasnap|TelegramDesktop|TelegramDesktop/tdata'
|
||||
package_manager_install_pattern='npm[[:space:]]+install|bun[[:space:]]+add'
|
||||
|
||||
usage() {
|
||||
cat <<'USAGE'
|
||||
@@ -347,8 +349,8 @@ for base in "${cache_dir_bases[@]}"; do
|
||||
done
|
||||
|
||||
if [[ -s "${packaging_files}" ]]; then
|
||||
xargs -0 grep -HnEi 'atomic-lockfile|tdatasnap|TelegramDesktop|TelegramDesktop/tdata' < "${packaging_files}" 2>/dev/null >> "${packaging_specific}" || true
|
||||
xargs -0 grep -HnE 'npm[[:space:]]+install' < "${packaging_files}" 2>/dev/null >> "${packaging_npm}" || true
|
||||
xargs -0 grep -HnEi "${payload_pattern}" < "${packaging_files}" 2>/dev/null >> "${packaging_specific}" || true
|
||||
xargs -0 grep -HnE "${package_manager_install_pattern}" < "${packaging_files}" 2>/dev/null >> "${packaging_npm}" || true
|
||||
fi
|
||||
|
||||
awk 'NR == FNR { bad[$1] = 1; next } bad[$1] { print }' "${bad_list}" "${cache_dirs}" > "${cache_matches_raw}"
|
||||
@@ -369,7 +371,7 @@ find_bases=(
|
||||
|
||||
for base in "${find_bases[@]}"; do
|
||||
[[ -n "${base}" && -d "${base}" ]] || continue
|
||||
find "${base}" \( -iname '*atomic-lockfile*' -o -iname '*tdatasnap*' \) -print 2>/dev/null >> "${file_indicators}"
|
||||
find "${base}" \( -iname '*atomic-lockfile*' -o -iname '*lockfile-js*' -o -iname '*js-digest*' -o -iname '*tdatasnap*' \) -print 2>/dev/null >> "${file_indicators}"
|
||||
done
|
||||
|
||||
persistence_bases=(
|
||||
@@ -380,10 +382,10 @@ persistence_bases=(
|
||||
|
||||
for base in "${persistence_bases[@]}"; do
|
||||
[[ -n "${base}" && -d "${base}" ]] || continue
|
||||
grep -RInEi 'atomic-lockfile|tdatasnap|TelegramDesktop/tdata' "${base}" 2>/dev/null >> "${persistence_indicators}" || true
|
||||
grep -RInEi "${payload_pattern}" "${base}" 2>/dev/null >> "${persistence_indicators}" || true
|
||||
done
|
||||
|
||||
pgrep -af 'atomic-lockfile|tdatasnap|TelegramDesktop/tdata' > "${process_indicators}" 2>/dev/null || true
|
||||
pgrep -af "${payload_pattern}" > "${process_indicators}" 2>/dev/null || true
|
||||
|
||||
mark_high "${foreign_matches}"
|
||||
mark_high "${known_foreign_matches}"
|
||||
@@ -418,7 +420,7 @@ show_result REVIEW "local pacman -U command history matched the AUR list" "${pac
|
||||
show_result FOUND "recent local pacman -U command history matched the AUR list" "${recent_pacman_u_matches}" "no recent local pacman -U command history matched the AUR list"
|
||||
show_result REVIEW "AUR helper cache directories matched the AUR list" "${cache_matches}" "no AUR helper cache directories matched the AUR list"
|
||||
show_result FOUND "specific payload indicators were found in packaging files" "${packaging_specific}" "no specific payload indicators were found in packaging files"
|
||||
show_result REVIEW "npm install was found in packaging files" "${packaging_npm}" "no npm install lines were found in packaging files"
|
||||
show_result REVIEW "npm or bun package installation was found in packaging files" "${packaging_npm}" "no npm or bun package installation lines were found in packaging files"
|
||||
show_result FOUND "payload indicator file names were found" "${file_indicators}" "no payload indicator file names were found"
|
||||
show_result FOUND "payload indicators were found in persistence locations" "${persistence_indicators}" "no payload indicators were found in persistence locations"
|
||||
show_result FOUND "payload indicators were found in running processes" "${process_indicators}" "no payload indicators were found in running processes"
|
||||
|
||||
Reference in New Issue
Block a user