From 926f99fd2c4bfbf2136a0d542e1353a243ba9ac1 Mon Sep 17 00:00:00 2001 From: Oscar Wallberg Date: Sat, 13 Jun 2026 15:12:18 +0200 Subject: [PATCH] feat(scripts): update AUR malware checker --- scripts/check-aur-malware.packages | 176 ++++++++++++++++++----------- scripts/check-aur-malware.sh | 26 +++-- 2 files changed, 122 insertions(+), 80 deletions(-) diff --git a/scripts/check-aur-malware.packages b/scripts/check-aur-malware.packages index 97cdf15..8757e58 100644 --- a/scripts/check-aur-malware.packages +++ b/scripts/check-aur-malware.packages @@ -30,10 +30,10 @@ android-backup-extractor android-docs android-google-play-apk-expansion android-google-play-licensing -androidscreencast-bin android-signapk android-signapk-gui android-support-repository +androidscreencast-bin annobin ansible-language-server ant-dracula-gtk-theme @@ -48,15 +48,18 @@ apm_planner-bin apothem apple-music-desktop apwal +aquaria-ose +ar-smileys +arachnophilia arcadia +arch-palemoon-search +arch-update-vai archivemail archjh archlinux-themes-balou archlinux-themes-slim archmage -arch-palemoon-search archtex-git -arch-update-vai arduino-git argouml aria2fe @@ -64,9 +67,9 @@ ariang-allinone arm-linux-gnueabihf-binutils arm-linux-gnueabihf-glibc-headers arm-linux-gnueabihf-linux-api-headers -ar-smileys artanis-git ascii-rain-git +asciiworld-git astah-uml astro-editor-appimage asus-fan-dkms-git @@ -129,19 +132,25 @@ bouml bpytop-git bracket brightness-controller-git +brother-hl3150cdw +brother-hll6200dw brow6el brow6el-git brscan3 bsnes-plus-git burn-cd +c++-gtk-utils-gtk2 caelum +camotics canon-pixma-mg3000-complete-fixed capt-src capture +cardano-node cartridge-cli castawesome castersoundboard-git cattle +cavestory+-hb cb2bib ccase-bin cccc @@ -149,10 +158,10 @@ ccl-git ccminer-git ccsm-gtk3 cdo +centerim5-git cerbere-git cerebro cgminer -c++-gtk-utils-gtk2 cgvg charcoal chexquest3-wad @@ -162,6 +171,8 @@ chipmunk chisel chromeos-apk-git cinny-desktop-system-tray +cint +cjs-git clai clamfs clang15 @@ -174,9 +185,11 @@ cmake-modules-webos-git cmospwd cmuclmtk cnijfilter-common +cnijfilter-common-mg5400 cnijfilter-ip110 cnijfilter-mp550 code-git +codeclimate codeigniter codenomad-bin codeql-cli-bin @@ -186,14 +199,18 @@ colorhug-client colorsvn colorz compiler-rt19 -compizconfig-python compiz-fusion-plugins-experimental compiz-fusion-plugins-experimental-git compiz-fusion-plugins-extra +compiz-fusion-plugins-extra-git +compizconfig-python +compizconfig-python-git +complexity connman-ncurses connman-ncurses-git connman-ui-git containerd-git +contemporary-cursors controllermap coolreader coolreader3-git @@ -202,10 +219,10 @@ cowdancer coyim cpp-netlib cppreference-devhelp +cpu-monitor-extension-lxpanel-plugin cpufreqd cpuminer-multi cpuminer-multi-git -cpu-monitor-extension-lxpanel-plugin cpuset craftbukkit-plugin-worldedit createvm @@ -229,8 +246,8 @@ cutefish-settings cutefish-statusbar cutefish-wallpapers cutemarked-git -cvs2svn cvs-feature-bin +cvs2svn cwiid cynthiune.app d1x-rebirth @@ -286,8 +303,8 @@ dvorak7min dyad-bin dynamodb e4rat-lite-git -easymp3gain-qt4-bin easy_spice +easymp3gain-qt4-bin easytag-git echinus-git echo-icon-theme-git @@ -302,9 +319,9 @@ efiboots-git eisl electrum-bin electrum-nmc -elmerfem elm-format-bin elm-platform +elmerfem emacs-color-theme emacs-d-mode emacs-ess-git @@ -343,9 +360,9 @@ exiftags exodas exodis exodud +exodus-wallet-bin exoduss exoduswallet -exodus-wallet-bin exodux exoduz exodys @@ -359,13 +376,13 @@ fastoggenc fatx fbctrl fbff-git -fcitx5-pinyin-sougou-dict-git fcitx-baidupinyin +fcitx5-pinyin-sougou-dict-git fengoffice ffdiaporama-texturemate -ffmpeg3.4 ffmpeg-bitrate-stats ffmpeg-quality-metrics +ffmpeg3.4 fifth filebot47 findpkg-git @@ -380,8 +397,8 @@ flashfocus flatcam-git flexiblas flow -flowblade-git flow-pomodoro +flowblade-git flv2x264 flynarwhal fmlib @@ -431,12 +448,12 @@ gimp-plugin-arrow gist-git gisto git-annex-standalone -gitflow-avh git-flow-completion-git +git-remote-hg-git +gitflow-avh gitfs gitinspector gitosis-git -git-remote-hg-git gitso gitter-bin gkraken @@ -468,8 +485,8 @@ gnome-usage-git gnome-xcf-thumbnailer gnuplot-git gnutls3.8.9 -gogs-git gog-the-witcher-2-assassins-of-kings +gogs-git gohufont-powerline gopenvpn-git gopher2600 @@ -479,34 +496,35 @@ gosh gpicsync gpshell gpx-viewer +gr-osmosdr-git graal-bin graveman -greenisland green-tunnel-bin +greenisland greetd-wlgreet-git gridmgr-git grim-git -gr-osmosdr-git grpn -grub4dos grub-luks-keyfile +grub4dos gsettings-desktop-schemas-git -gtkimageview -gtksetpwc gtk-theme-bsm-simple gtk-theme-metagrip gtk-theme-windows10-dark gtk-vnc-gtk2 +gtkimageview +gtksetpwc guake-colors-solarized-git guile-git guile-reader guile-ssh +guiscrcpy gummy gummy-git gxemul +ha-pacemaker-git hackmatrix-git halberd -ha-pacemaker-git hardcode-tray harminv harmony-wad @@ -514,6 +532,7 @@ haskell-asn1-data haskell-chart haskell-failure haskell-hscurses +haskell-hssyck hattrick_organizer haunt haxe-git @@ -534,6 +553,7 @@ hop horst hotlinemiami howm-x11-git +hp-health hpgcc hpoj htdig @@ -547,8 +567,8 @@ hydrus-git hypervc-qt4 hypr-git i2c-ch341-dkms -i3bar-river i3-gnome-git +i3bar-river i3lock-fancy-dualmonitors-git ianny-bin ibc @@ -565,6 +585,7 @@ ikos imageglass img2djvu-git inadyn +inadyn-mt indicator-session infinity-background infnoise-openssl-git @@ -587,16 +608,18 @@ jasmin jasp-desktop java-berkeleydb java-flexdock -javahelp2 java-qdox +javahelp2 jd-gui +jdk-openj9-bin jdk11-openj9-bin jdk17-jetbrains-bin jdk8-graalvm-bin -jdk-openj9-bin +jetbrains-mps jflex jin joxi +joy joycon-git joymouse jreen-git @@ -611,13 +634,18 @@ katrain kdb kddockwidgets-git kdevelop-pg-qt-git +keep +keepass-fr +keepass-plugin-qualitycolumn keepassx2 keeperrl-git kexi kicad-library-ab2-git kiconedit kimageformats-git +kio_gopher kiss +kmarkdownwebview kodi-addon-inputstream-adaptive-git kokua-secondlife kompare-git @@ -729,11 +757,11 @@ linux-cachyos-native-nvidia-open linux-cachyos-rc-native linux-cachyos-rc-native-headers linux-cachyos-rc-native-nvidia-open -linux_logo_archcustom linux-manjaro-xanmod linux-rc linux-tool linux-xanmod-rog +linux_logo_archcustom linvst liri-cmake-shared-git liri-shell-git @@ -755,8 +783,8 @@ lure lv lxdvdrip m5rcode -machinarium mac-os-lion-cursors +machinarium madsonic magicassistant-gtk magpie-wm @@ -772,9 +800,10 @@ mathsat-5 mato-icons-git matrixbrandy maxima-git -mcpatcher -mcp-probe +mbm-gpsd-pl4nkton-git mc-skin-modarin-debian +mcp-probe +mcpatcher me_cleaner-git menumaker-compiz mermaid-ascii-git @@ -827,13 +856,14 @@ movgrab mp3guessenc mpir mqttfx-bin -msieve ms-office-online +msieve multimon-ng-git multiwinia mxnet mysqltuner-git mythes-cs +n-ninja n1-translator naemon naemon-livestatus @@ -879,7 +909,6 @@ nikola-git nip2 nixnote2 nixnote2-git -n-ninja nocodb noctyra-dotfiles-git noctyra-meta-git @@ -896,10 +925,10 @@ notify-desktop-git notion-app-enhanced nox-bin nrpe +num-utils numix-gtk-theme numix-themes-electric numix-themes-green -num-utils nvdock-bumblebee nvidia-xrun-git nwchem @@ -914,18 +943,18 @@ oclint octave-hg octave-miscellaneous octocode +oh-my-git ohcount ohcount-git -oh-my-git olivia-git -openav-sorcer-git open-axiom +open-hexagon-git +openav-sorcer-git opencode-codebase-index-bin opencorsairlink-git opendrop openhab2 openhab3 -open-hexagon-git openms openmsx-catapult opennebula @@ -1001,13 +1030,13 @@ pharo-bin phonon-qt4 phonon-qt5-vlc php-blackfire -phpdocumentor2 php-geoip php-legacy-memcache php-memcache php-openswoole-git -phpredis-git php-xdiff +phpdocumentor2 +phpredis-git picom-ftlabs-git picpuz pidgin-cmds @@ -1053,24 +1082,6 @@ pypi-cli pypiserver pypy-setuptools pyrescene-git -python2-appdirs -python2-cffi -python2-chardet -python2-cssselect -python2-ctypes -python2-fusepy -python2-gobject -python2-lazr-uri -python2-mutagen -python2-notify -python2-packaging -python2-paver -python2-pyparsing -python2-simplejson -python2-simpleparse -python2-stomper -python2-twodict-git -python2-xlib python-affine python-apt python-argdispatch @@ -1087,9 +1098,9 @@ python-cu2qu-git python-dataproperty python-dbapi-compliance python-dictobject +python-dj-database-url python-django-modelcluster python-django-rest-knox -python-dj-database-url python-dugong python-epc python-fastmcp-slim @@ -1151,6 +1162,24 @@ python-uhi python-uproot python-vector python-xtarfile +python2-appdirs +python2-cffi +python2-chardet +python2-cssselect +python2-ctypes +python2-fusepy +python2-gobject +python2-lazr-uri +python2-mutagen +python2-notify +python2-packaging +python2-paver +python2-pyparsing +python2-simplejson +python2-simpleparse +python2-stomper +python2-twodict-git +python2-xlib pytomtom pyxplot qbittorrent-enhanced-qt5 @@ -1180,6 +1209,7 @@ quickswitch-i3 qutepart-git qv2ray-git qwt-qt4 +r-dbplyr r2-iaito-git r8101-dkms rabbitvcs-cli @@ -1192,7 +1222,6 @@ rainbarf-git rarian ratox-git rbutil-git -r-dbplyr rdm-bin rdup reactphysics3d @@ -1256,8 +1285,8 @@ ruby-sprockets-rails ruby-thread_safe ruby-travis rumor -runescape-launcher run-mailcap +runescape-launcher rxvt-unicode-256xresources sachesi-bin sakura-launcher-gui @@ -1280,12 +1309,13 @@ sddm-stellar-theme sdformat seahorse-nautilus selenium-server-standalone +sentry sequencer64-git sex sfarkxtc sfnt2woff -shadowgrounds shadow-tech +shadowgrounds sheeplifter shellcheck-git shellinabox-git @@ -1299,8 +1329,8 @@ signald silver-searcher-git sixfireusb-dkms skanlite-git -slime-git slim-unicode +slime-git slipnet slipnet-bin smartsim-git @@ -1312,6 +1342,7 @@ snapd-git snis-git snowman-git snry-shell-qs +so-synth-lv2-git soapyptezuka socnetv softethervpn-client-manager @@ -1322,7 +1353,6 @@ sonar-icon-theme sonixd sonosano sope2 -so-synth-lv2-git soundpaad-bin soxt spigot-plugin-essentials @@ -1394,12 +1424,12 @@ toggldesktop tomighty toolsched toontown-rewritten +tor-messenger-bin tora torch7-cutorch-git torch7-git torch7-image-git torch7-trepl-git -tor-messenger-bin tortoisehg-hg touchhle touchosc-bin @@ -1415,7 +1445,6 @@ trytond tsm tsocks-tools ttcp -ttf2eot ttf-consolas-powerline ttf-dejavu-emojiless ttf-dejavu-sans-mono-powerline-git @@ -1426,6 +1455,7 @@ ttf-material-design-icons-git ttf-mutant-emoji ttf-pizzadude-bullets ttf-roboto-fontconfig +ttf2eot tunacode-cli tup-git tuxboot-git @@ -1446,6 +1476,7 @@ upower-nocritical urbanbrawl-wad urho3d urjtag-git +usbmount vapoursynth-preview-git vbam-git vcp-git @@ -1460,9 +1491,11 @@ vidcutter video-contact-sheet viennacl vim-clang-complete-git +vim-delimitmate vim-easymotion vim-fortran vim-gitgutter +vim-hexman vim-indent-object vim-lighttpd vim-live-latex-preview @@ -1470,6 +1503,8 @@ vim-manpageview vim-molokai vim-molokai-git vim-octave +vim-omlet +vim-pandoc-syntax-git vim-pathogen-git vim-perl-support vim-pythonhelper @@ -1490,17 +1525,18 @@ vuze-extreme-mod vuze-plugin-countrylocator vuze-plugin-mldht wallpaper-generator-next +wally watchman watsup wavbreaker wayland-static wcalc wds +we-layerd-git webilder-gtk-patched webui-aria2-git wechat-devtools weex -we-layerd-git wemux-git wesnoth-git whatsie-git @@ -1510,11 +1546,13 @@ whitebox whysynth windowmaker-git windows2usb-git -wineasio-git wine-nine +wineasio-git +wings2 wire-desktop wiringpi-git wlroots-nvidia +wmtop word-snatchers-cli workbench workbuddy-bin @@ -1529,6 +1567,7 @@ xapian-omega xarchiver-assume-name xcursor-gt3 xerox-phaser-6000-6010 +xevdevserver xf86-input-cmt xf86-input-joystick xf86-input-mtrack @@ -1557,6 +1596,7 @@ yofrankie yokadi yt6801-dkms yy +z-push zafiro-icon-theme zaproxy-weekly zathura-gruvbox-git @@ -1574,6 +1614,6 @@ zing-17-bin zing-21-bin zing-8-bin zinnia-python -z-push zrythm-git -zsdx \ No newline at end of file +zsdx +zxtune-git diff --git a/scripts/check-aur-malware.sh b/scripts/check-aur-malware.sh index d3ef737..9d3bc58 100755 --- a/scripts/check-aur-malware.sh +++ b/scripts/check-aur-malware.sh @@ -8,12 +8,12 @@ set -uo pipefail # accounts. The live package list URL below is the working list linked from that # thread. # -# Reports around this wave included unexpected npm payload paths and indicators -# such as atomic-lockfile and tdatasnap, with TelegramDesktop/tdata mentioned as -# a possible data theft target. The script checks installed foreign packages, -# pacman history, AUR helper caches, and those payload indicators. Keep -# check-aur-malware.packages next to this script as a bundled fallback because -# the live HedgeDoc note may move or disappear. +# Reports around this wave included unexpected npm and bun package installation, +# malicious package names such as atomic-lockfile, lockfile-js, and js-digest, +# and TelegramDesktop/tdata as a possible data theft target. The script checks +# installed foreign packages, pacman history, AUR helper caches, and those +# payload indicators. Keep check-aur-malware.packages next to this script as a +# bundled fallback because the live HedgeDoc note may move or disappear. # # Sources: # - Arch AUR report thread: https://lists.archlinux.org/archives/list/aur-general%40lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/ @@ -31,6 +31,8 @@ script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)" bundled_list="${script_dir}/check-aur-malware.packages" cache_dir="${XDG_CACHE_HOME:-${HOME:-}/.cache}/aur-malware-check" cached_list="${cache_dir}/package-list.txt" +payload_pattern='atomic-lockfile|lockfile-js|js-digest|tdatasnap|TelegramDesktop|TelegramDesktop/tdata' +package_manager_install_pattern='npm[[:space:]]+install|bun[[:space:]]+add' usage() { cat <<'USAGE' @@ -347,8 +349,8 @@ for base in "${cache_dir_bases[@]}"; do done if [[ -s "${packaging_files}" ]]; then - xargs -0 grep -HnEi 'atomic-lockfile|tdatasnap|TelegramDesktop|TelegramDesktop/tdata' < "${packaging_files}" 2>/dev/null >> "${packaging_specific}" || true - xargs -0 grep -HnE 'npm[[:space:]]+install' < "${packaging_files}" 2>/dev/null >> "${packaging_npm}" || true + xargs -0 grep -HnEi "${payload_pattern}" < "${packaging_files}" 2>/dev/null >> "${packaging_specific}" || true + xargs -0 grep -HnE "${package_manager_install_pattern}" < "${packaging_files}" 2>/dev/null >> "${packaging_npm}" || true fi awk 'NR == FNR { bad[$1] = 1; next } bad[$1] { print }' "${bad_list}" "${cache_dirs}" > "${cache_matches_raw}" @@ -369,7 +371,7 @@ find_bases=( for base in "${find_bases[@]}"; do [[ -n "${base}" && -d "${base}" ]] || continue - find "${base}" \( -iname '*atomic-lockfile*' -o -iname '*tdatasnap*' \) -print 2>/dev/null >> "${file_indicators}" + find "${base}" \( -iname '*atomic-lockfile*' -o -iname '*lockfile-js*' -o -iname '*js-digest*' -o -iname '*tdatasnap*' \) -print 2>/dev/null >> "${file_indicators}" done persistence_bases=( @@ -380,10 +382,10 @@ persistence_bases=( for base in "${persistence_bases[@]}"; do [[ -n "${base}" && -d "${base}" ]] || continue - grep -RInEi 'atomic-lockfile|tdatasnap|TelegramDesktop/tdata' "${base}" 2>/dev/null >> "${persistence_indicators}" || true + grep -RInEi "${payload_pattern}" "${base}" 2>/dev/null >> "${persistence_indicators}" || true done -pgrep -af 'atomic-lockfile|tdatasnap|TelegramDesktop/tdata' > "${process_indicators}" 2>/dev/null || true +pgrep -af "${payload_pattern}" > "${process_indicators}" 2>/dev/null || true mark_high "${foreign_matches}" mark_high "${known_foreign_matches}" @@ -418,7 +420,7 @@ show_result REVIEW "local pacman -U command history matched the AUR list" "${pac show_result FOUND "recent local pacman -U command history matched the AUR list" "${recent_pacman_u_matches}" "no recent local pacman -U command history matched the AUR list" show_result REVIEW "AUR helper cache directories matched the AUR list" "${cache_matches}" "no AUR helper cache directories matched the AUR list" show_result FOUND "specific payload indicators were found in packaging files" "${packaging_specific}" "no specific payload indicators were found in packaging files" -show_result REVIEW "npm install was found in packaging files" "${packaging_npm}" "no npm install lines were found in packaging files" +show_result REVIEW "npm or bun package installation was found in packaging files" "${packaging_npm}" "no npm or bun package installation lines were found in packaging files" show_result FOUND "payload indicator file names were found" "${file_indicators}" "no payload indicator file names were found" show_result FOUND "payload indicators were found in persistence locations" "${persistence_indicators}" "no payload indicators were found in persistence locations" show_result FOUND "payload indicators were found in running processes" "${process_indicators}" "no payload indicators were found in running processes"