Libgdata : AUR malware check flagged Official Repository (extra)

[karen]

Hello,

I have a few AUR packages installed to be able to build stuff from source. Interestingly one that is installed currently from Official Repoistory (extra) libgdata is listed as both “AUR and Repositories” at the same time. If I click on it in pamac gui, on the left side, under ALL, Installed and Repositories it shows up, but it also shows up under AUR, and the version is the same, and it it changes to AUR below the description in the list too.

I bring this up because I did the AUR malware check and got this result:

[resove@resove-ws aur-malware-check]$ python -m aur_check --full
[INFO] AUR list: /home/resove/aur-hakd/aur-malware-check/data/lists/package_list.txt
[INFO] NPM list: /home/resove/aur-hakd/aur-malware-check/data/lists/malicious_npm_packages.txt
[INFO] Loaded 1935 AUR packages from 1 source(s)
[INFO] Loaded 4 npm packages from 1 source(s)
[INFO] Date window: 2026-06-09 to 2026-06-12
[INFO] Pacman log glob: /var/log/pacman.log*
============================================================
 AUR Malware Check v4.0
 Campaign: malicious npm packages (malicious_npm_packages.txt) infostealer + eBPF rootkit
 Date window: 2026-06-09 to 2026-06-12
 Packages checked: 1935
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages installed within campaign window.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.

--- [3] Systemd persistence check ---
  Clean: no suspicious systemd services found.

--- [4] eBPF rootkit check ---
  Clean: no eBPF rootkit traces detected.

--- [5] npm cache check ---
  Clean: no malicious packages in npm cache.

--- [6] bun cache check ---
  Clean: no malicious packages in bun cache.

============================================================
 RESULT: CLEAN - No indicators found.
============================================================
[resove@resove-ws aur-malware-check]$ python -m aur_check --all-time
[INFO] AUR list: /home/resove/aur-hakd/aur-malware-check/data/lists/package_list.txt
[INFO] NPM list: /home/resove/aur-hakd/aur-malware-check/data/lists/malicious_npm_packages.txt
[INFO] Loaded 1935 AUR packages from 1 source(s)
[INFO] Loaded 4 npm packages from 1 source(s)
[INFO] Date window: all-time (no recency filter)
[INFO] Pacman log glob: /var/log/pacman.log*
============================================================
 AUR Malware Check v4.0
 Campaign: malicious npm packages (malicious_npm_packages.txt) infostealer + eBPF rootkit
 Date window: all-time (no recency filter)
 Packages checked: 1935
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages currently installed.

--- [2] Historical pacman logs ---
LOG_HIT: gnome-shell-extension-x11gestures (upgraded on 2025-05-02)
LOG_HIT: libgdata (upgraded on 2025-06-15)
LOG_HIT: libgdata (upgraded on 2026-04-17)
  WARNING: historical log matches:
  - gnome-shell-extension-x11gestures (upgraded on 2025-05-02)
  - libgdata (upgraded on 2025-06-15)
  - libgdata (upgraded on 2026-04-17)

============================================================
 RESULT: INFECTED - Indicators found! Follow incident response.
============================================================

Incident response is to check what services you have running and look for any abnormal ones. I am uncertain what services ship with Manjaro and which ones I’ve added. I’m here to ask for help on identifying if:

1. did this package replace my AUR one at some point? Why does it display as existing in both AUR and Repoistory?

2. Below is a list of my servces running. Can anyone help me troubleshoot / inspect if they should be there? Thanks so much!

lines 1-34/34 (END)
  UNIT                                 LOAD   ACTIVE SUB     DESCRIPTION                                                           
  accounts-daemon.service              loaded active running Accounts Service
  bluetooth.service                    loaded active running Bluetooth service
  bolt.service                         loaded active running Thunderbolt system service
  colord.service                       loaded active running Manage, Install and Generate Color Profiles
  cups.service                         loaded active running CUPS Scheduler
  dbus-broker.service                  loaded active running D-Bus System Message Bus
  dirmngr@etc-pacman.d-gnupg.service   loaded active running GnuPG network certificate management daemon for /etc/pacman.d/gnupg
  fprintd.service                      loaded active running Fingerprint Authentication Daemon
  gdm.service                          loaded active running GNOME Display Manager
  gpg-agent@etc-pacman.d-gnupg.service loaded active running GnuPG cryptographic agent and passphrase cache for /etc/pacman.d/gnupg
  ModemManager.service                 loaded active running Modem Manager
  NetworkManager.service               loaded active running Network Manager
  pamac-daemon.service                 loaded active running Pamac Daemon
  polkit.service                       loaded active running Authorization Manager
  power-profiles-daemon.service        loaded active running Power Profiles daemon
  rtkit-daemon.service                 loaded active running RealtimeKit Scheduling Policy Service
  sshd.service                         loaded active running OpenSSH Daemon
  systemd-journald.service             loaded active running Journal Service
  systemd-logind.service               loaded active running User Login Management
  systemd-timesyncd.service            loaded active running Network Time Synchronization
  systemd-udevd.service                loaded active running Rule-based Manager for Device Events and Files
  systemd-userdbd.service              loaded active running User Database Manager
  touchegg.service                     loaded active running Touchégg Daemon
  udisks2.service                      loaded active running Disk Manager
  upower.service                       loaded active running Daemon for power management
  user@1000.service                    loaded active running User Manager for UID 1000
  wpa_supplicant.service               loaded active running WPA supplicant

Legend: LOAD   → Reflects whether the unit definition was properly loaded.
        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
        SUB    → The low-level unit activation state, values depend on unit type.

27 loaded units listed.

[resove-ws resove]# inxi -rIaxz
Repos:
  Packages: pm: pacman pkgs: 1833 libs: 535 tools: gnome-software,pamac,yay
    pm: flatpak pkgs: 0
  Active pacman repo servers in: /etc/pacman.d/mirrorlist
    1: https://muug.ca/mirror/manjaro/stable/$repo/$arch
    2: https://ftp.tsukuba.wide.ad.jp/Linux/manjaro/stable/$repo/$arch
    3: https://ask4.mm.fcix.net/manjaro/stable/$repo/$arch
    4: https://mirrors.atlas.net.co/manjaro/stable/$repo/$arch
    5: https://www.mirrorservice.org/sites/repo.manjaro.org/repos/stable/$repo/$arch
    6: https://mirrors.ft.uam.es/manjaro/stable/$repo/$arch
    7: https://mirrors.ustc.edu.cn/manjaro/stable/$repo/$arch
    8: https://mirror.dc.uz/manjaro/stable/$repo/$arch
Info:
  Memory: total: 128 GiB note: est. available: 123.61 GiB
    used: 20.64 GiB (16.7%)
  Processes: 542 Power: uptime: 25d 22h 40m states: freeze,mem,disk
    suspend: deep avail: s2idle wakeups: 0 hibernate: platform avail: shutdown,
    reboot, suspend, test_resume image: 49.35 GiB services: gsd-power,
    power-profiles-daemon, upowerd Init: systemd v: 260 default: graphical
    tool: systemctl
  Compilers: clang: 22.1.5 gcc: 16.1.1 alt: 15 Shell: Bash (su) v: 5.3.9
    running-in: gnome-terminal inxi: 3.3.40

[scotty65]

libgdata has been dropped from the Arch repos, and that change has so far made it across to Manjaro’s Unstable & Testing branches:

mbn info libgdata -q | grep -Ev 'Name|Repository|Packager'
Branch         : stable
Version        : 0.18.1-5
Build Date     : Sat 28 Feb 2026 11:20:31 
AUR            : ------
Version        : 0.18.1-5
Date           : Fri 12 Jun 2026 03:29:18 
Url            : https://aur.archlinux.org/packages/libgdata

Branch compare for Manjaro - libgdata

It should disappear from Stable branch next update.

So, as long as the libgdata package installed on your system is the one from Manjaro’s repos, you can safely ignore the AUR malware check flag.

[karen]

that’s part of the problem, i don’t know. It says it’s from both

And if I attempt to uninstall the AUR i get it appearing to uninstall the official package :

I just read an article about it some more.

It appears it was Gnome that dropped support for Gdrive (which I don’t have or use) and apparently someone submitted a bug report. The libgdata is the package that needs it. Nobody has volunteered to maintain the package/ nobody cares about Gdrive, so now i also understand why the package is disappearing.

It seems it might have been installed for nautalis integration, but it’s no longer required/ supported. Thanks for your help and understanding why I can safely uninstall it anyway.

Mod edit: Consecutive posts merged.

[scotty65]

@karen

that’s part of the problem, i don’t know. It says it’s from both

Run this command:

pamac info libgdata | grep -Ei 'Name|Version|Repository|Install Date'

If it was installed before 2026-05-31 (the date the libgdata package was added to the AUR), then you can be certain that it was installed from the official repos.

[karen]

[resove-ws resove]# pamac info libgdata | grep -Ei 'Name|Version|Repository|Install Date'
Name                  : libgdata
Version               : 0.18.1-5
Repository            : extra
Install Date          : Fri 17 Apr 2026 02:18:05 PM

Thanks @scotty65
https://www.xda-developers.com/gnome-50-killed-google-drive-integration-nobody-wanted-to-maintain-it/
I wonder if it will impact AOSP builds? hmmmmm

[giulia_privacy408]

That output is reassuring: Repository: extra and an April install date means your installed package came from the repo, not from the AUR copy. For the AOSP question I’d just check who still pulls it in before removing it, e.g. pacman -Qi libgdata and maybe pactree -r libgdata if you have pacman-contrib. If nothing you care about depends on it, removing it is cleaner than keeping a library you do not use.