Hi everyone,
Is there an up-to-date list of all infected packages somewhere where you can easily search for your installed AUR packages using copy and paste?
1 Like
Is there any news. Can we install from the AUR again or are there still waves of attack going on?
If you read this thread you will see some scripts that will do just that for you.
AUR is right now as secure/insecure as always. The last wave of attacks were just profanity, but even that seems to be controlled right now. Archlinux devs have disabled AUR sign ups for now.
8 Likes
Hi all.
Is this command enough to determine if you’re infected?
sudo find -type d -name "atomic-lockfile" -o -name "js-digest" 2>/dev/null
Or is it better to use one of the recommended scripts anyway?
Mod edit:- In future, please format all code, commands and command output according to forum guidelines
[Mini-HowTo] Present code or command output
Note: Grave accent (or, backtick) characters are used. 
For inline code or to show a single command:
- please follow this simple example:
code here.
For multi-line command output:
- place text beween two rows of three (```) backtick characters to form a scrollable text box, or …
- use the </> button in the Compose window to achieve the same result.
The empty row between these rows of backtick characters is where to paste any multi-line command output (such as inxi).
An example of a pre-formatted text enclosure:
What is a Quark?
A. In Physics, an elementary particle and fundamental constituent of matter.
B. A character from the Star Trek: "Deep Space Nine" television series.
C. A soft, creamy, usually unsalted cheese traditional to central Europe.
Use the scripts. All the important links are in the first 3 posts.
8 Likes
The blog from the first post recommends the following:
Also, just for good measure (and this is for everyone), deny outbound Tor traffic from your network.
Seems to be a good idea to me, since I am not using Tor at all. How would I implement this?
I’d use these commands:
sudo systemctl stop tor
sudo systemctl disable tor
I don’t know what ports Tor uses, so can’t advise on that.
I’m not too sure - maybe a block on Port 9001, 9030 - apparently that blocks connections to ‘standard’ Tor relays… but how about Tor connections using bridges or obfuscated transports?
I think you have to get a list of Tor exit node IPs and block them all.
I think you’d need to generate a script to import them periodically…
1 Like
Meanwhile:
What’s this? Plugins?
I imagine this as one more question “wanna see pkgbuild?” before build (like “do you want cleanbuild”, “do you want to see the diff” questions we have now) but we’ll see how they really implemented this when it comes.
Or just as a single command… 
sudo systemctl disable --now tor
3 Likes
That is, if the malicious process was so nice to make a service for tor naming it tor 
3 Likes
Small update to my previous post: I adapted the XFCE helper for lenucksi’s aur-malware-check to the new Python command:
python -m aur_check --refresh --full
It remains a simple convenience wrapper: it updates the original scanner repository, stops if the update fails, runs the current scan command, cleans local refreshed list changes afterwards, and adds an XFCE menu launcher.
Helper:
Original scanner:
I don’t about yay, but trizen had these implemented from the start, you just setup a config file for what you want to see during an installation. The only thing it seems to be missing are hooks.
1 Like
FYI…
This is my init.lua for yay 13. The lua is part of a complete setup.
cat ~/.config/yay/init.lua
-- ~/.config/yay/init.lua
--
-- yay 13.0 Lua hooks for the AUR security stack.
-- Seeded to ~/.config/yay/init.lua by install.sh if not already present.
-- These hooks run on every AUR install/upgrade alongside aurscan pre-checks.
-- See docs/my-setup.md, "yay 13.0 integration".
-- Options
yay.opt.diff_menu = true
yay.opt.edit_menu = true -- prompt to review PKGBUILD before build
yay.opt.clean_menu = true
yay.opt.clean_after = false
yay.opt.sort_by = "votes"
yay.opt.bottom_up = false
-- Warn about AUR packages with PKGBUILD modified < 3 days ago
yay.create_autocmd("UpgradeSelect", {
desc = "flag recently modified AUR upgrades",
callback = function(event)
local cutoff = os.time() - (3 * 24 * 60 * 60)
for _, pkg in ipairs(event.data.upgrades) do
if pkg.repository == "aur" and pkg.last_modified >= cutoff then
local hours = math.floor((os.time() - pkg.last_modified) / 3600)
yay.log.warn(pkg.name .. ": PKGBUILD modified "
.. hours .. "h ago — review carefully")
end
end
return { exclude = {}, skip_menu = false }
end,
})
-- Static pattern check before build (complements aurscan)
yay.create_autocmd("AURPreInstall", {
desc = "block known malicious PKGBUILD patterns",
callback = function(event)
local pkg = event.match
local pkgbuild = event.data.pkgbuild
local patterns = {
"npm install atomic%-lockfile", -- Atomic Arch campaign wave 1
"bun install js%-digest", -- wave 2
"curl.*|.*bash",
"curl.*|.*sh",
"wget.*|.*bash",
"wget.*|.*sh",
}
for _, pattern in ipairs(patterns) do
if pkgbuild:match(pattern) then
yay.abort(pkg .. ": blocked — suspicious pattern: " .. pattern)
end
end
end,
})
-- Log AUR installs
yay.create_autocmd("PostInstall", {
desc = "log AUR installs",
callback = function(event)
for _, pkg in ipairs(event.data.packages) do
if pkg.source == "aur" then
yay.log.info("AUR installed: " .. pkg.name .. " " .. pkg.version)
end
end
end,
})
-- >>> aurscan begin (managed block; do not edit by hand)
-- aurscan: scan each AUR package (PKGBUILD + downloaded sources) before install.
yay.create_autocmd("AURPostDownload", {
desc = "aurscan pre-build malware scan",
callback = function(event)
local function shq(s) return "'" .. tostring(s):gsub("'", "'\\''") .. "'" end
local cmd = "/usr/local/bin/aurscan" .. " --prebuild " .. shq(event.data.dir)
if os.execute(cmd) ~= 0 then
yay.abort(event.match .. ": blocked by aurscan")
end
end,
})
-- <<< aurscan end
Complete setup see. [BETA]
I named it Archcanary. Canary in the coalmine.
It would be great to get feedback. Testers etc 
Use Github Discussion or Issues. Rather no questions in this topic to keep it clean.
In development….. 
Why this message fits here. It also scans for the malware list discussed in the topic.
4 Likes
Cool, i just tested it and
--- [10] XDG autostart + shell RC persistence check ---
WARNING: suspicious autostart entry: /home/teo/.config/autostart/xfce-panel-workaround.desktop
Exec=/etc/skel/.config/autostart/xfce-pbw.sh (outside standard system path)
If you recognize this app (e.g. an AppImage/Flatpak launcher or a
personal script), mark it known-good: pkexec /usr/lib/archcanary/root-helper --allowlist-add=autostart:/etc/skel/.config/autostart/xfce-pbw.sh
Since this is part of the default install - or at least was in 2023 - i guess you have to white list it. It is guaranteed false positive on xfce.
Otherwise, for some reason the “infected” window in the gui is very high (the lower part goes out of screen.)
I am on Manjaro since:
stat / | awk '/Birth: /{print $2}'
2019-02-09
And the “workaround” script xfce-pbw.sh was here since such date; some years ago, I discovered that (at least on my system - maybe thanks to the SSD or the amount of RAM - 16 GiB) is completely useless, with the added problem that it slows down the boot process to the desktop. So, yeah: is definitely a false positive.
1 Like
I think i even saw this on my xubuntu in 2014. Pretty sure the bug causing some race condition and crashing the settings daemon is solved by now, but does not hurt to have it. I do not think it can slow down boot (nothing explicitly waits for it - it is just the settings daemon restarted a minute after boot).
1 Like
Looks like the AUR nightmare continues
I even started fresh after the last one because I didnt trust the install. Sadly it was 6 years old and highly customized. With the new one I didnt add a lot of AUR packages, but I did add a few, and checked the PKGBUILD. But I am not a malware expert. I have enough on my plate without starting another new install.
1 Like