feat(scripts): update AUR malware checker

scripts/check-aur-malware.packages

@@ -30,10 +30,10 @@ android-backup-extractor
 android-docs
 android-google-play-apk-expansion
 android-google-play-licensing
-androidscreencast-bin
 android-signapk
 android-signapk-gui
 android-support-repository
+androidscreencast-bin
 annobin
 ansible-language-server
 ant-dracula-gtk-theme
@@ -48,15 +48,18 @@ apm_planner-bin
 apothem
 apple-music-desktop
 apwal
+aquaria-ose
+ar-smileys
+arachnophilia
 arcadia
+arch-palemoon-search
+arch-update-vai
 archivemail
 archjh
 archlinux-themes-balou
 archlinux-themes-slim
 archmage
-arch-palemoon-search
 archtex-git
-arch-update-vai
 arduino-git
 argouml
 aria2fe
@@ -64,9 +67,9 @@ ariang-allinone
 arm-linux-gnueabihf-binutils
 arm-linux-gnueabihf-glibc-headers
 arm-linux-gnueabihf-linux-api-headers
-ar-smileys
 artanis-git
 ascii-rain-git
+asciiworld-git
 astah-uml
 astro-editor-appimage
 asus-fan-dkms-git
@@ -129,19 +132,25 @@ bouml
 bpytop-git
 bracket
 brightness-controller-git
+brother-hl3150cdw
+brother-hll6200dw
 brow6el
 brow6el-git
 brscan3
 bsnes-plus-git
 burn-cd
+c++-gtk-utils-gtk2
 caelum
+camotics
 canon-pixma-mg3000-complete-fixed
 capt-src
 capture
+cardano-node
 cartridge-cli
 castawesome
 castersoundboard-git
 cattle
+cavestory+-hb
 cb2bib
 ccase-bin
 cccc
@@ -149,10 +158,10 @@ ccl-git
 ccminer-git
 ccsm-gtk3
 cdo
+centerim5-git
 cerbere-git
 cerebro
 cgminer
-c++-gtk-utils-gtk2
 cgvg
 charcoal
 chexquest3-wad
@@ -162,6 +171,8 @@ chipmunk
 chisel
 chromeos-apk-git
 cinny-desktop-system-tray
+cint
+cjs-git
 clai
 clamfs
 clang15
@@ -174,9 +185,11 @@ cmake-modules-webos-git
 cmospwd
 cmuclmtk
 cnijfilter-common
+cnijfilter-common-mg5400
 cnijfilter-ip110
 cnijfilter-mp550
 code-git
+codeclimate
 codeigniter
 codenomad-bin
 codeql-cli-bin
@@ -186,14 +199,18 @@ colorhug-client
 colorsvn
 colorz
 compiler-rt19
-compizconfig-python
 compiz-fusion-plugins-experimental
 compiz-fusion-plugins-experimental-git
 compiz-fusion-plugins-extra
+compiz-fusion-plugins-extra-git
+compizconfig-python
+compizconfig-python-git
+complexity
 connman-ncurses
 connman-ncurses-git
 connman-ui-git
 containerd-git
+contemporary-cursors
 controllermap
 coolreader
 coolreader3-git
@@ -202,10 +219,10 @@ cowdancer
 coyim
 cpp-netlib
 cppreference-devhelp
+cpu-monitor-extension-lxpanel-plugin
 cpufreqd
 cpuminer-multi
 cpuminer-multi-git
-cpu-monitor-extension-lxpanel-plugin
 cpuset
 craftbukkit-plugin-worldedit
 createvm
@@ -229,8 +246,8 @@ cutefish-settings
 cutefish-statusbar
 cutefish-wallpapers
 cutemarked-git
-cvs2svn
 cvs-feature-bin
+cvs2svn
 cwiid
 cynthiune.app
 d1x-rebirth
@@ -286,8 +303,8 @@ dvorak7min
 dyad-bin
 dynamodb
 e4rat-lite-git
-easymp3gain-qt4-bin
 easy_spice
+easymp3gain-qt4-bin
 easytag-git
 echinus-git
 echo-icon-theme-git
@@ -302,9 +319,9 @@ efiboots-git
 eisl
 electrum-bin
 electrum-nmc
-elmerfem
 elm-format-bin
 elm-platform
+elmerfem
 emacs-color-theme
 emacs-d-mode
 emacs-ess-git
@@ -343,9 +360,9 @@ exiftags
 exodas
 exodis
 exodud
+exodus-wallet-bin
 exoduss
 exoduswallet
-exodus-wallet-bin
 exodux
 exoduz
 exodys
@@ -359,13 +376,13 @@ fastoggenc
 fatx
 fbctrl
 fbff-git
-fcitx5-pinyin-sougou-dict-git
 fcitx-baidupinyin
+fcitx5-pinyin-sougou-dict-git
 fengoffice
 ffdiaporama-texturemate
-ffmpeg3.4
 ffmpeg-bitrate-stats
 ffmpeg-quality-metrics
+ffmpeg3.4
 fifth
 filebot47
 findpkg-git
@@ -380,8 +397,8 @@ flashfocus
 flatcam-git
 flexiblas
 flow
-flowblade-git
 flow-pomodoro
+flowblade-git
 flv2x264
 flynarwhal
 fmlib
@@ -431,12 +448,12 @@ gimp-plugin-arrow
 gist-git
 gisto
 git-annex-standalone
-gitflow-avh
 git-flow-completion-git
+git-remote-hg-git
+gitflow-avh
 gitfs
 gitinspector
 gitosis-git
-git-remote-hg-git
 gitso
 gitter-bin
 gkraken
@@ -468,8 +485,8 @@ gnome-usage-git
 gnome-xcf-thumbnailer
 gnuplot-git
 gnutls3.8.9
-gogs-git
 gog-the-witcher-2-assassins-of-kings
+gogs-git
 gohufont-powerline
 gopenvpn-git
 gopher2600
@@ -479,34 +496,35 @@ gosh
 gpicsync
 gpshell
 gpx-viewer
+gr-osmosdr-git
 graal-bin
 graveman
-greenisland
 green-tunnel-bin
+greenisland
 greetd-wlgreet-git
 gridmgr-git
 grim-git
-gr-osmosdr-git
 grpn
-grub4dos
 grub-luks-keyfile
+grub4dos
 gsettings-desktop-schemas-git
-gtkimageview
-gtksetpwc
 gtk-theme-bsm-simple
 gtk-theme-metagrip
 gtk-theme-windows10-dark
 gtk-vnc-gtk2
+gtkimageview
+gtksetpwc
 guake-colors-solarized-git
 guile-git
 guile-reader
 guile-ssh
+guiscrcpy
 gummy
 gummy-git
 gxemul
+ha-pacemaker-git
 hackmatrix-git
 halberd
-ha-pacemaker-git
 hardcode-tray
 harminv
 harmony-wad
@@ -514,6 +532,7 @@ haskell-asn1-data
 haskell-chart
 haskell-failure
 haskell-hscurses
+haskell-hssyck
 hattrick_organizer
 haunt
 haxe-git
@@ -534,6 +553,7 @@ hop
 horst
 hotlinemiami
 howm-x11-git
+hp-health
 hpgcc
 hpoj
 htdig
@@ -547,8 +567,8 @@ hydrus-git
 hypervc-qt4
 hypr-git
 i2c-ch341-dkms
-i3bar-river
 i3-gnome-git
+i3bar-river
 i3lock-fancy-dualmonitors-git
 ianny-bin
 ibc
@@ -565,6 +585,7 @@ ikos
 imageglass
 img2djvu-git
 inadyn
+inadyn-mt
 indicator-session
 infinity-background
 infnoise-openssl-git
@@ -587,16 +608,18 @@ jasmin
 jasp-desktop
 java-berkeleydb
 java-flexdock
-javahelp2
 java-qdox
+javahelp2
 jd-gui
+jdk-openj9-bin
 jdk11-openj9-bin
 jdk17-jetbrains-bin
 jdk8-graalvm-bin
-jdk-openj9-bin
+jetbrains-mps
 jflex
 jin
 joxi
+joy
 joycon-git
 joymouse
 jreen-git
@@ -611,13 +634,18 @@ katrain
 kdb
 kddockwidgets-git
 kdevelop-pg-qt-git
+keep
+keepass-fr
+keepass-plugin-qualitycolumn
 keepassx2
 keeperrl-git
 kexi
 kicad-library-ab2-git
 kiconedit
 kimageformats-git
+kio_gopher
 kiss
+kmarkdownwebview
 kodi-addon-inputstream-adaptive-git
 kokua-secondlife
 kompare-git
@@ -729,11 +757,11 @@ linux-cachyos-native-nvidia-open
 linux-cachyos-rc-native
 linux-cachyos-rc-native-headers
 linux-cachyos-rc-native-nvidia-open
-linux_logo_archcustom
 linux-manjaro-xanmod
 linux-rc
 linux-tool
 linux-xanmod-rog
+linux_logo_archcustom
 linvst
 liri-cmake-shared-git
 liri-shell-git
@@ -755,8 +783,8 @@ lure
 lv
 lxdvdrip
 m5rcode
-machinarium
 mac-os-lion-cursors
+machinarium
 madsonic
 magicassistant-gtk
 magpie-wm
@@ -772,9 +800,10 @@ mathsat-5
 mato-icons-git
 matrixbrandy
 maxima-git
-mcpatcher
+mbm-gpsd-pl4nkton-git
-mcp-probe
 mc-skin-modarin-debian
+mcp-probe
+mcpatcher
 me_cleaner-git
 menumaker-compiz
 mermaid-ascii-git
@@ -827,13 +856,14 @@ movgrab
 mp3guessenc
 mpir
 mqttfx-bin
-msieve
 ms-office-online
+msieve
 multimon-ng-git
 multiwinia
 mxnet
 mysqltuner-git
 mythes-cs
+n-ninja
 n1-translator
 naemon
 naemon-livestatus
@@ -879,7 +909,6 @@ nikola-git
 nip2
 nixnote2
 nixnote2-git
-n-ninja
 nocodb
 noctyra-dotfiles-git
 noctyra-meta-git
@@ -896,10 +925,10 @@ notify-desktop-git
 notion-app-enhanced
 nox-bin
 nrpe
+num-utils
 numix-gtk-theme
 numix-themes-electric
 numix-themes-green
-num-utils
 nvdock-bumblebee
 nvidia-xrun-git
 nwchem
@@ -914,18 +943,18 @@ oclint
 octave-hg
 octave-miscellaneous
 octocode
+oh-my-git
 ohcount
 ohcount-git
-oh-my-git
 olivia-git
-openav-sorcer-git
 open-axiom
+open-hexagon-git
+openav-sorcer-git
 opencode-codebase-index-bin
 opencorsairlink-git
 opendrop
 openhab2
 openhab3
-open-hexagon-git
 openms
 openmsx-catapult
 opennebula
@@ -1001,13 +1030,13 @@ pharo-bin
 phonon-qt4
 phonon-qt5-vlc
 php-blackfire
-phpdocumentor2
 php-geoip
 php-legacy-memcache
 php-memcache
 php-openswoole-git
-phpredis-git
 php-xdiff
+phpdocumentor2
+phpredis-git
 picom-ftlabs-git
 picpuz
 pidgin-cmds
@@ -1053,24 +1082,6 @@ pypi-cli
 pypiserver
 pypy-setuptools
 pyrescene-git
-python2-appdirs
-python2-cffi
-python2-chardet
-python2-cssselect
-python2-ctypes
-python2-fusepy
-python2-gobject
-python2-lazr-uri
-python2-mutagen
-python2-notify
-python2-packaging
-python2-paver
-python2-pyparsing
-python2-simplejson
-python2-simpleparse
-python2-stomper
-python2-twodict-git
-python2-xlib
 python-affine
 python-apt
 python-argdispatch
@@ -1087,9 +1098,9 @@ python-cu2qu-git
 python-dataproperty
 python-dbapi-compliance
 python-dictobject
+python-dj-database-url
 python-django-modelcluster
 python-django-rest-knox
-python-dj-database-url
 python-dugong
 python-epc
 python-fastmcp-slim
@@ -1151,6 +1162,24 @@ python-uhi
 python-uproot
 python-vector
 python-xtarfile
+python2-appdirs
+python2-cffi
+python2-chardet
+python2-cssselect
+python2-ctypes
+python2-fusepy
+python2-gobject
+python2-lazr-uri
+python2-mutagen
+python2-notify
+python2-packaging
+python2-paver
+python2-pyparsing
+python2-simplejson
+python2-simpleparse
+python2-stomper
+python2-twodict-git
+python2-xlib
 pytomtom
 pyxplot
 qbittorrent-enhanced-qt5
@@ -1180,6 +1209,7 @@ quickswitch-i3
 qutepart-git
 qv2ray-git
 qwt-qt4
+r-dbplyr
 r2-iaito-git
 r8101-dkms
 rabbitvcs-cli
@@ -1192,7 +1222,6 @@ rainbarf-git
 rarian
 ratox-git
 rbutil-git
-r-dbplyr
 rdm-bin
 rdup
 reactphysics3d
@@ -1256,8 +1285,8 @@ ruby-sprockets-rails
 ruby-thread_safe
 ruby-travis
 rumor
-runescape-launcher
 run-mailcap
+runescape-launcher
 rxvt-unicode-256xresources
 sachesi-bin
 sakura-launcher-gui
@@ -1280,12 +1309,13 @@ sddm-stellar-theme
 sdformat
 seahorse-nautilus
 selenium-server-standalone
+sentry
 sequencer64-git
 sex
 sfarkxtc
 sfnt2woff
-shadowgrounds
 shadow-tech
+shadowgrounds
 sheeplifter
 shellcheck-git
 shellinabox-git
@@ -1299,8 +1329,8 @@ signald
 silver-searcher-git
 sixfireusb-dkms
 skanlite-git
-slime-git
 slim-unicode
+slime-git
 slipnet
 slipnet-bin
 smartsim-git
@@ -1312,6 +1342,7 @@ snapd-git
 snis-git
 snowman-git
 snry-shell-qs
+so-synth-lv2-git
 soapyptezuka
 socnetv
 softethervpn-client-manager
@@ -1322,7 +1353,6 @@ sonar-icon-theme
 sonixd
 sonosano
 sope2
-so-synth-lv2-git
 soundpaad-bin
 soxt
 spigot-plugin-essentials
@@ -1394,12 +1424,12 @@ toggldesktop
 tomighty
 toolsched
 toontown-rewritten
+tor-messenger-bin
 tora
 torch7-cutorch-git
 torch7-git
 torch7-image-git
 torch7-trepl-git
-tor-messenger-bin
 tortoisehg-hg
 touchhle
 touchosc-bin
@@ -1415,7 +1445,6 @@ trytond
 tsm
 tsocks-tools
 ttcp
-ttf2eot
 ttf-consolas-powerline
 ttf-dejavu-emojiless
 ttf-dejavu-sans-mono-powerline-git
@@ -1426,6 +1455,7 @@ ttf-material-design-icons-git
 ttf-mutant-emoji
 ttf-pizzadude-bullets
 ttf-roboto-fontconfig
+ttf2eot
 tunacode-cli
 tup-git
 tuxboot-git
@@ -1446,6 +1476,7 @@ upower-nocritical
 urbanbrawl-wad
 urho3d
 urjtag-git
+usbmount
 vapoursynth-preview-git
 vbam-git
 vcp-git
@@ -1460,9 +1491,11 @@ vidcutter
 video-contact-sheet
 viennacl
 vim-clang-complete-git
+vim-delimitmate
 vim-easymotion
 vim-fortran
 vim-gitgutter
+vim-hexman
 vim-indent-object
 vim-lighttpd
 vim-live-latex-preview
@@ -1470,6 +1503,8 @@ vim-manpageview
 vim-molokai
 vim-molokai-git
 vim-octave
+vim-omlet
+vim-pandoc-syntax-git
 vim-pathogen-git
 vim-perl-support
 vim-pythonhelper
@@ -1490,17 +1525,18 @@ vuze-extreme-mod
 vuze-plugin-countrylocator
 vuze-plugin-mldht
 wallpaper-generator-next
+wally
 watchman
 watsup
 wavbreaker
 wayland-static
 wcalc
 wds
+we-layerd-git
 webilder-gtk-patched
 webui-aria2-git
 wechat-devtools
 weex
-we-layerd-git
 wemux-git
 wesnoth-git
 whatsie-git
@@ -1510,11 +1546,13 @@ whitebox
 whysynth
 windowmaker-git
 windows2usb-git
-wineasio-git
 wine-nine
+wineasio-git
+wings2
 wire-desktop
 wiringpi-git
 wlroots-nvidia
+wmtop
 word-snatchers-cli
 workbench
 workbuddy-bin
@@ -1529,6 +1567,7 @@ xapian-omega
 xarchiver-assume-name
 xcursor-gt3
 xerox-phaser-6000-6010
+xevdevserver
 xf86-input-cmt
 xf86-input-joystick
 xf86-input-mtrack
@@ -1557,6 +1596,7 @@ yofrankie
 yokadi
 yt6801-dkms
 yy
+z-push
 zafiro-icon-theme
 zaproxy-weekly
 zathura-gruvbox-git
@@ -1574,6 +1614,6 @@ zing-17-bin
 zing-21-bin
 zing-8-bin
 zinnia-python
-z-push
 zrythm-git
-zsdx
+zsdx
+zxtune-git

scripts/check-aur-malware.sh

@@ -8,12 +8,12 @@ set -uo pipefail
 # accounts. The live package list URL below is the working list linked from that
 # thread.
 #
-# Reports around this wave included unexpected npm payload paths and indicators
+# Reports around this wave included unexpected npm and bun package installation,
-# such as atomic-lockfile and tdatasnap, with TelegramDesktop/tdata mentioned as
+# malicious package names such as atomic-lockfile, lockfile-js, and js-digest,
-# a possible data theft target. The script checks installed foreign packages,
+# and TelegramDesktop/tdata as a possible data theft target. The script checks
-# pacman history, AUR helper caches, and those payload indicators. Keep
+# installed foreign packages, pacman history, AUR helper caches, and those
-# check-aur-malware.packages next to this script as a bundled fallback because
+# payload indicators. Keep check-aur-malware.packages next to this script as a
-# the live HedgeDoc note may move or disappear.
+# bundled fallback because the live HedgeDoc note may move or disappear.
 #
 # Sources:
 # - Arch AUR report thread: https://lists.archlinux.org/archives/list/aur-general%40lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
@@ -31,6 +31,8 @@ script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
 bundled_list="${script_dir}/check-aur-malware.packages"
 cache_dir="${XDG_CACHE_HOME:-${HOME:-}/.cache}/aur-malware-check"
 cached_list="${cache_dir}/package-list.txt"
+payload_pattern='atomic-lockfile|lockfile-js|js-digest|tdatasnap|TelegramDesktop|TelegramDesktop/tdata'
+package_manager_install_pattern='npm[[:space:]]+install|bun[[:space:]]+add'
 
 usage() {
     cat <<'USAGE'
@@ -347,8 +349,8 @@ for base in "${cache_dir_bases[@]}"; do
 done
 
 if [[ -s "${packaging_files}" ]]; then
-    xargs -0 grep -HnEi 'atomic-lockfile|tdatasnap|TelegramDesktop|TelegramDesktop/tdata' < "${packaging_files}" 2>/dev/null >> "${packaging_specific}" || true
+    xargs -0 grep -HnEi "${payload_pattern}" < "${packaging_files}" 2>/dev/null >> "${packaging_specific}" || true
-    xargs -0 grep -HnE 'npm[[:space:]]+install' < "${packaging_files}" 2>/dev/null >> "${packaging_npm}" || true
+    xargs -0 grep -HnE "${package_manager_install_pattern}" < "${packaging_files}" 2>/dev/null >> "${packaging_npm}" || true
 fi
 
 awk 'NR == FNR { bad[$1] = 1; next } bad[$1] { print }' "${bad_list}" "${cache_dirs}" > "${cache_matches_raw}"
@@ -369,7 +371,7 @@ find_bases=(
 
 for base in "${find_bases[@]}"; do
     [[ -n "${base}" && -d "${base}" ]] || continue
-    find "${base}" \( -iname '*atomic-lockfile*' -o -iname '*tdatasnap*' \) -print 2>/dev/null >> "${file_indicators}"
+    find "${base}" \( -iname '*atomic-lockfile*' -o -iname '*lockfile-js*' -o -iname '*js-digest*' -o -iname '*tdatasnap*' \) -print 2>/dev/null >> "${file_indicators}"
 done
 
 persistence_bases=(
@@ -380,10 +382,10 @@ persistence_bases=(
 
 for base in "${persistence_bases[@]}"; do
     [[ -n "${base}" && -d "${base}" ]] || continue
-    grep -RInEi 'atomic-lockfile|tdatasnap|TelegramDesktop/tdata' "${base}" 2>/dev/null >> "${persistence_indicators}" || true
+    grep -RInEi "${payload_pattern}" "${base}" 2>/dev/null >> "${persistence_indicators}" || true
 done
 
-pgrep -af 'atomic-lockfile|tdatasnap|TelegramDesktop/tdata' > "${process_indicators}" 2>/dev/null || true
+pgrep -af "${payload_pattern}" > "${process_indicators}" 2>/dev/null || true
 
 mark_high "${foreign_matches}"
 mark_high "${known_foreign_matches}"
@@ -418,7 +420,7 @@ show_result REVIEW "local pacman -U command history matched the AUR list" "${pac
 show_result FOUND "recent local pacman -U command history matched the AUR list" "${recent_pacman_u_matches}" "no recent local pacman -U command history matched the AUR list"
 show_result REVIEW "AUR helper cache directories matched the AUR list" "${cache_matches}" "no AUR helper cache directories matched the AUR list"
 show_result FOUND "specific payload indicators were found in packaging files" "${packaging_specific}" "no specific payload indicators were found in packaging files"
-show_result REVIEW "npm install was found in packaging files" "${packaging_npm}" "no npm install lines were found in packaging files"
+show_result REVIEW "npm or bun package installation was found in packaging files" "${packaging_npm}" "no npm or bun package installation lines were found in packaging files"
 show_result FOUND "payload indicator file names were found" "${file_indicators}" "no payload indicator file names were found"
 show_result FOUND "payload indicators were found in persistence locations" "${persistence_indicators}" "no payload indicators were found in persistence locations"
 show_result FOUND "payload indicators were found in running processes" "${process_indicators}" "no payload indicators were found in running processes"