How to identify if a AUR package is malware and virus free?

Is there a package or a tool or a service for that I can run in background at all times?

Hello @AyushAkarsh :wink:

In short: No, there is no “virus scanner” for AUR packages.

But in general, keep an eye on the PKGBUILDs.

  1. Check which source is used.
  2. Check what the script does.
  3. Downloaded packages are checked with either gpg signature or checksum to ensure that it really the correct packages.
  4. You are not the only one who uses AUR. If a package contains malware, it will removed quickly. Also check always the comments on https://aur.archlinux.org of the PKGBUILDs.

So in general you are on your own, if you trust the maintainer and the application which you are installing or not.

5 Likes

Hi!..

@megavolt has given you a very nice technical answer. Let me to give you such a practical advice:

  1. Open the Pamac.
  2. Pick the search button on the top left of the Pamac app.
  3. Search for the package you want.
  4. Double click on the AUR package you want.
  5. Watch carefully for the following data on the page that will open:
    a) The source’s website.
    b) The AUR package build website.
    c) The first submission date.
    d) The last change date.
    e) The vote’s number.

That might not to be such a perfect science, but with that information on hand you’ll certainly to be able to make good decisions!..

Have a nice day and don’t fear the AUR just because “the internet” says it is dangerous!.. At least it is far less dangerous than running the “odd” website to download that random .EXE file!.. :slight_smile:

Have a nice day!..

3 Likes

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.