AURWatch watches the Arch User Repository so you don't have to read every PKGBUILD yourself: it scans every package for dangerous patterns (remote code execution, curl | sh, obfuscated payloads, untrusted download hosts) with static rules plus an AI second opinion, and re-scans every 2 hours.
It's a one-person side project that I build, run and pay for myself. If a package ever gets flagged wrongly, that's an honest mistake on my end and never an accusation against the maintainer. Just hit Report a package and I'll sort it out.
Wrong verdict, or a package we missed?
Recently flagged (last 24h)
All packages →| Package | Maintainer | Votes | Severity | Triggered rules |
|---|---|---|---|---|
| ttf-symbola-bin | arianesteckel | 14 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| xfwm4-themes-bin | brunoharing | 11 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| sonicthehedgehog2 | gameslayer | 2 | High piracy | External download from an untrusted host, not in source=(), AI review of an ambiguous pattern |
| aksusbd-bin | – | 1 | High | pip install of an external package, AI review of an ambiguous pattern |
| altirra | imcb | 1 | High piracy | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| com.seewo.easinote5 | – | 1 | High piracy | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| cstrike-appimage | azzbcc | 1 | High piracy | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| cxstudy-wine | jingluwei | 1 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| editorconfiger | melaniecastro | 1 | High | External install via pipx/uv/poetry/cargo/go/gem, AI review of an ambiguous pattern |
| jazzjackrabbit | gameslayer | 1 | High piracy | External download from an untrusted host, not in source=(), AI review of an ambiguous pattern |
| sm64ex-redrawn-60fps-git | – | 1 | High piracy | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| solv | mariahaverinen | 1 | High | External install via pipx/uv/poetry/cargo/go/gem, AI review of an ambiguous pattern |
| flymaster | cavernico | 0 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| gitio-git | gameplayer | 0 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| irreader | AsukaMinato | 0 | High piracy | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| ld64 | Dralanjhgi | 0 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| mcc | zyriu1 | 0 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| newitemmonitor | AsukaMinato | 0 | High piracy | npm/yarn/pnpm install of an undeclared external package, AI review of an ambiguous pattern |
| nice-boat | kokokoshka | 0 | High piracy | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| qoder-cli | Pakrohk | 0 | High | External download from an untrusted host, not in source=(), AI review of an ambiguous pattern |
| rootvim | realSUDO | 0 | High | npm/yarn/pnpm install of an undeclared external package, AI review of an ambiguous pattern |
| spiritfarer-appimage | azzbcc | 0 | High piracy | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| symantec-ghost | severach | 0 | High piracy broken | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| ydict | DreamSaddle | 0 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| gtk2-ng-git-bin | mairemakela | 0 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| openssl-1.1-bin | geraldbraun | 0 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| botan2-bin | curthornig | 0 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| libkolabxml-bin | masontammerijn | 0 | High | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| x11-qemu-validation | japao | 0 | High | Privileged / out-of-pacman install (sudoers, setuid, or self-update), Few votes, recently uploaded, AI review of an ambiguous pattern |
| chromium-snapshot-bin | mrxx | 494 | Medium | External download from an untrusted host, not in source=(), source=() URL on a non-standard host, AI review of an ambiguous pattern |
| wps-office | Universebenzene | 488 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| wps-office-mime | Universebenzene | 488 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| insync | thenaterhood | 324 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| spotify | gromit | 276 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| spideroak-one | warnem2 | 262 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| enemy-territory | The_Loko | 259 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| enemy-territory-data | The_Loko | 259 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| epsxe | hav3lock | 226 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| palemoon-bin | oberon2007 | 197 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| acestream-engine | qark | 131 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| itch-setup-bin | FabioLolix | 127 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| fcitx-sogoupinyin | qft | 112 | Medium | External download from an untrusted host, not in source=(), AI review of an ambiguous pattern |
| linuxqq | Integral | 111 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| jdk8 | severach | 103 | Medium | source=() URL on a non-standard host, AI review of an ambiguous pattern |
| cursor-bin | g.schulz | 95 | Medium | source=() URL on a non-standard host |
| pcloud-drive | zbe | 95 | Medium | External download from an untrusted host, not in source=(), source=() URL on a non-standard host, AI review |
| claude-code | cg505 | 94 | Medium | source=() URL on a non-standard host |
| enpass-bin | tadly | 88 | Medium | source=() URL on a non-standard host, AI review |
| amdapp-sdk | rigred | 84 | Medium | source=() URL on a non-standard host, AI review |
| amdapp-sdk-opencv | rigred | 84 | Medium | source=() URL on a non-standard host, AI review |
| amdapp-sdk-nocatalyst | rigred | 84 | Medium | source=() URL on a non-standard host, AI review |
| amdapp-sdk-docs | rigred | 84 | Medium | source=() URL on a non-standard host, AI review |
| wemeet-bin | sukanka | 83 | Medium | source=() URL on a non-standard host, AI review |
| bouml | yngvelevin | 80 | Medium | source=() URL on a non-standard host, AI review |
| cloudflare-warp-bin | solatis | 77 | Medium | source=() URL on a non-standard host, AI review |
| kindlegen | alerque | 77 | Medium | source=() URL on a non-standard host, AI review |
| nessus | noraj | 73 | Medium | source=() URL on a non-standard host, AI review |
| staruml | CookieUniverse | 72 | Medium | source=() URL on a non-standard host, AI review |
| lmstudio-bin | noureddinex | 67 | Medium | source=() URL on a non-standard host, AI review |
| android-studio-canary | lalitm | 65 | Medium | source=() URL on a non-standard host |
| savage2 | Slash | 65 | Medium | source=() URL on a non-standard host, AI review |
| virtualbox-bin | dbermond | 62 | Medium | source=() URL on a non-standard host, Privileged / out-of-pacman install (sudoers, setuid, or self-update), AI review |
| virtualbox-bin-guest-iso | dbermond | 62 | Medium | source=() URL on a non-standard host, Privileged / out-of-pacman install (sudoers, setuid, or self-update), AI review |
| virtualbox-bin-sdk | dbermond | 62 | Medium | source=() URL on a non-standard host, Privileged / out-of-pacman install (sudoers, setuid, or self-update), AI review |
| parsec-bin | zen | 58 | Medium | source=() URL on a non-standard host, AI review |
| megasync-bin | rpanerai | 56 | Medium | source=() URL on a non-standard host |
| quake4 | Slash | 55 | Medium | source=() URL on a non-standard host, AI review |
| synology-drive | warnem2 | 55 | Medium | source=() URL on a non-standard host, AI review |
| heidisql | D3SOX | 54 | Medium | External download from an untrusted host, not in source=(), AI review |
| noip | runnytu | 54 | Medium | source=() URL on a non-standard host, AI review |
| xmind | bacteriostat | 54 | Medium | source=() URL on a non-standard host, AI review |
| yandex-browser | labaman | 49 | Medium | source=() URL on a non-standard host, Privileged / out-of-pacman install (sudoers, setuid, or self-update), AI review |
| freedownloadmanager | rizwan486 | 48 | Medium | source=() URL on a non-standard host, AI review |
| warsaw-bin | tioguda | 47 | Medium | source=() URL on a non-standard host, AI review |
| hybrid-encoder | JohnyRi | 46 | Medium | source=() URL on a non-standard host, AI review |
| proton-pass-bin | DodoGTA | 46 | Medium | source=() URL on a non-standard host, AI review |
| feedthebeast-classic | FurTabs | 45 | Medium | source=() URL on a non-standard host, AI review |
| visual-studio-code-insiders-bin | dcelasun | 42 | Medium | source=() URL on a non-standard host |
| pulse-secure | akosmolnar | 41 | Medium | source=() URL on a non-standard host, AI review |
| ultravnc-viewer | Muflone | 40 | Medium | source=() URL on a non-standard host, AI review |
| mikutter | gomasy | 39 | Medium | External install via pipx/uv/poetry/cargo/go/gem, source=() URL on a non-standard host, AI review |
| warsaw | nicolascomman | 39 | Medium | source=() URL on a non-standard host, AI review |
| nx3-all | filipprochazkova | 38 | Medium | source=() URL on a non-standard host, AI review |
| termius | tbk | 37 | Medium | source=() URL on a non-standard host, AI review |
| xp-pen-tablet | labaman | 37 | Medium | source=() URL on a non-standard host, AI review |
| discord-canary | timschumi | 36 | Medium | source=() URL on a non-standard host |
| opera | Refreeze5911 | 36 | Medium | source=() URL on a non-standard host, AI review |
| slimjet | ahmedmoselhi | 36 | Medium | External download from an untrusted host, not in source=(), AI review |
| valentina-studio | bobolin | 36 | Medium | source=() URL on a non-standard host, AI review |
| throne | parhelia | 34 | Medium | External install via pipx/uv/poetry/cargo/go/gem |
| oracle-instantclient-basic | Malvineous | 33 | Medium | source=() URL on a non-standard host, AI review |
| chatgpt-desktop | Akira-Amatsume | 33 | Medium | source=() URL on a non-standard host, AI review |
| ayugram-desktop-bin | RSG245 | 31 | Medium | source=() URL on a non-standard host, AI review |
| jpcsp | soimort | 31 | Medium | source=() URL on a non-standard host, AI review |
| devin-desktop | bermudi | 30 | Medium | Recently orphaned & re-adopted, AI review |
| surfshark-client | otaj | 30 | Medium | source=() URL on a non-standard host, AI review |
| flashpoint-launcher-bin | hmarcelino | 29 | Medium | source=() URL on a non-standard host |
| ida-free | fatalis | 29 | Medium | source=() URL on a non-standard host, AI review |
| notion-app-electron | AsukaMinato | 29 | Medium | source=() URL on a non-standard host, AI review |
| wolf | Slash | 29 | Medium | source=() URL on a non-standard host, AI review |
| antigravity-cli | viridivn | 28 | Medium | source=() URL on a non-standard host, AI review |
| clash-for-windows-bin | Jat | 28 | Medium | source=() URL on a non-standard host, AI review |
| imagescan-plugin-networkscan | buzo | 28 | Medium | source=() URL on a non-standard host, AI review |
| localwp | airdiz | 27 | Medium | source=() URL on a non-standard host, AI review |
| nodejs-mkdirp | annikkitikkanen | 27 | Medium | npm/yarn/pnpm install of an undeclared external package, AI review |
| vk-messenger | CryZFix | 27 | Medium | source=() URL on a non-standard host, AI review |
| z-library-bin | macdems | 27 | Medium | source=() URL on a non-standard host, AI review |
| 8188eu-dkms | julieiversen | 26 | Medium | source=() URL on a non-standard host, AI review |
| kdrive-bin | Frankkkkk | 25 | Medium | source=() URL on a non-standard host, AI review |
| editix-free | Geballin | 24 | Medium | source=() URL on a non-standard host, AI review |
| local-by-flywheel-bin | peddamax | 24 | Medium | source=() URL on a non-standard host, AI review |
| obinskit | ScoopNewsworthy | 24 | Medium | source=() URL on a non-standard host, AI review |
| flirc-bin | jsteel | 23 | Medium | source=() URL on a non-standard host, AI review |
| plex-desktop | username227 | 23 | Medium | source=() URL on a non-standard host, AI review |
| r-linux | mrxx | 23 | Medium | source=() URL on a non-standard host, AI review |
| samsung_magician-consumer-ssd | oberon2007 | 23 | Medium | source=() URL on a non-standard host, AI review |
| synergy2-bin | jaap | 23 | Medium | source=() URL on a non-standard host, AI review |
| chatgpt-desktop-bin | Akira-Amatsume | 23 | Medium | source=() URL on a non-standard host, AI review |
| aimp | badcast | 22 | Medium | source=() URL on a non-standard host, AI review |
| soundwire | Max-P | 22 | Medium | source=() URL on a non-standard host, AI review |
| wechat-devtools | theahermann | 22 | Medium | npm/yarn/pnpm install of an undeclared external package, source=() URL on a non-standard host, AI review downgraded a static finding |
| curseforge | txtsd | 21 | Medium | source=() URL on a non-standard host, AI review |
| forticlient | rhysperry111 | 21 | Medium | source=() URL on a non-standard host, AI review |
| sunloginclient | TimWcx | 21 | Medium | source=() URL on a non-standard host, AI review |
| tableplus | sistematico | 21 | Medium | source=() URL on a non-standard host, AI review |
| ticktick | Aerz | 21 | Medium | source=() URL on a non-standard host, AI review |
| wootility | AlphaLynx | 21 | Medium | source=() URL on a non-standard host, AI review |
| courier-maildrop | runnytu | 20 | Medium | Privileged / out-of-pacman install (sudoers, setuid, or self-update), AI review |
| hayase-desktop-bin | Duwangel | 20 | Medium | source=() URL on a non-standard host, AI review |
| microchip-mplabxc8-bin | rexploits | 20 | Medium | Privileged / out-of-pacman install (sudoers, setuid, or self-update), AI review |
| texturepacker | konez2k | 20 | Medium | source=() URL on a non-standard host, AI review |
| typora-free | irgendwr | 20 | Medium | source=() URL on a non-standard host, AI review |
| whatsdesk-bin | Abzie | 20 | Medium | source=() URL on a non-standard host, AI review |
| ancient-packages | Xavion | 19 | Medium | source=() URL on a non-standard host, AI review |
| aws-cli-bin | nsyntych | 19 | Medium | source=() URL on a non-standard host |
| popular-packages | Xavion | 19 | Medium | source=() URL on a non-standard host, AI review |
| clockify-desktop | jankoh | 18 | Medium | source=() URL on a non-standard host, AI review |
| encryptr | svantehedlund | 18 | Medium | source=() URL on a non-standard host, AI review |
| gdlauncher-bin | inetol | 18 | Medium | source=() URL on a non-standard host, AI review |
| lunacy-bin | smowtenshi | 18 | Medium | source=() URL on a non-standard host, AI review |
| hdsentinel | Archttila | 17 | Medium | source=() URL on a non-standard host, AI review |
| insync-dolphin | Xavier | 17 | Medium | source=() URL on a non-standard host, AI review |
| torguard | ABOhiccups | 17 | Medium | source=() URL on a non-standard host, AI review |
| warp-terminal-bin | noureddinex | 17 | Medium | source=() URL on a non-standard host |
| seatools-bin | nltimv | 17 | Medium | source=() URL on a non-standard host, AI review |
| aftershotpro3 | ava1ar | 16 | Medium | source=() URL on a non-standard host, AI review |
| atomicwallet | Bink | 16 | Medium | source=() URL on a non-standard host, AI review |
| beeper-bin | Sanitary4788 | 16 | Medium | source=() URL on a non-standard host, AI review |
| clickup | alhirzel | 16 | Medium | source=() URL on a non-standard host, AI review |
| dangerzone-bin | username227 | 16 | Medium | source=() URL on a non-standard host, AI review |
| jriver-media-center | blackhole | 16 | Medium | source=() URL on a non-standard host, AI review |
| sendanywhere | nailington | 16 | Medium | source=() URL on a non-standard host, AI review |
| f5vpn-ng | zrhoffman | 16 | Medium | source=() URL on a non-standard host, Privileged / out-of-pacman install (sudoers, setuid, or self-update), AI review |
| hoffice | 00ein00 | 15 | Medium | source=() URL on a non-standard host, AI review |
| huiontablet | jhon | 15 | Medium | source=() URL on a non-standard host, AI review |
| luxcorerender | bartus | 15 | Medium | External install via pipx/uv/poetry/cargo/go/gem, AI review |
| qqmusic-bin | Rukkhadevata123 | 15 | Medium | source=() URL on a non-standard host, AI review |
| baidunetdisk-electron | KafCoppelia | 14 | Medium | source=() URL on a non-standard host, AI review |
| bootstrap-studio | nathawat | 14 | Medium | source=() URL on a non-standard host, AI review |
| citra-appimage | AlphaJack | 14 | Medium | source=() URL on a non-standard host, AI review |
| ecodms-client | cmuench | 14 | Medium | source=() URL on a non-standard host, AI review |
| eddie-ui-git | Eddie.website | 14 | Medium | External download from an untrusted host, not in source=(), AI review |
| f5vpn | zrhoffman | 14 | Medium | source=() URL on a non-standard host, Privileged / out-of-pacman install (sudoers, setuid, or self-update), AI review |
| filebot47 | carolinedroz | 14 | Medium | source=() URL on a non-standard host, AI review |
| gitbutler-bin | DanielB | 14 | Medium | source=() URL on a non-standard host, AI review |
| lkeyholetv | tomoaki | 14 | Medium | source=() URL on a non-standard host, AI review |
| sir | szlachar | 14 | Medium | source=() URL on a non-standard host, AI review |
| superbeam | a-ludi | 14 | Medium | source=() URL on a non-standard host, AI review |
| chatbox-bin | richin13 | 13 | Medium | source=() URL on a non-standard host, AI review |
| cisco-secure-client | dmsh | 13 | Medium | source=() URL on a non-standard host, AI review |
| doom3-bin | Slash | 13 | Medium | source=() URL on a non-standard host, AI review |
| element-desktop-nightly-bin | davebloggt | 13 | Medium | source=() URL on a non-standard host |
| gfxbench | laetitiavermeil | 13 | Medium | source=() URL on a non-standard host, AI review |
| gopanda | dakling | 13 | Medium | source=() URL on a non-standard host, AI review |
| keeper-password-manager | malina | 13 | Medium | source=() URL on a non-standard host, AI review |
| mattercontrol | unlimitedbacon | 13 | Medium | source=() URL on a non-standard host, AI review |
| muse-sounds-manager-bin | aliu | 13 | Medium | source=() URL on a non-standard host, AI review |
| o3de-bin | xaque | 13 | Medium | source=() URL on a non-standard host, AI review |
| picoscope | mti | 13 | Medium | source=() URL on a non-standard host, AI review |
| remote-desktop-manager | tgm4883 | 13 | Medium | source=() URL on a non-standard host, AI review |
| vuze-extreme-mod | thilodoring | 13 | Medium | source=() URL on a non-standard host, AI review |
| ynab4 | Eeems | 13 | Medium | source=() URL on a non-standard host, AI review |
| yozo-office | zxp19821005 | 13 | Medium | source=() URL on a non-standard host, AI review |
| yozo-office-fonts | zxp19821005 | 13 | Medium | source=() URL on a non-standard host, AI review |
| yozo-office-templates | zxp19821005 | 13 | Medium | source=() URL on a non-standard host, AI review |
| gnome-encfs-manager-bin | xiota | 12 | Medium | source=() URL on a non-standard host, AI review |
| joxi | gyorgykocsis | 12 | Medium | source=() URL on a non-standard host, AI review |
| ocztoolbox | Muflone | 12 | Medium | source=() URL on a non-standard host, AI review |
| ostorybook | macxcool | 12 | Medium | source=() URL on a non-standard host, AI review |
| pkhex-bin | R0dn3yS | 12 | Medium | source=() URL on a non-standard host, AI review |
| safesignidentityclient | pedrohqb | 12 | Medium | source=() URL on a non-standard host, AI review |
| sejda-desktop | thibaultmol | 12 | Medium | source=() URL on a non-standard host, AI review |
| spotify-edge | Gobidev | 12 | Medium | source=() URL on a non-standard host, AI review |
| swi-prolog-devel | archery | 12 | Medium | source=() URL on a non-standard host |
| dart-sdk-dev | KlarkKable | 11 | Medium | source=() URL on a non-standard host |
| datomic-bin | harrigan | 11 | Medium | source=() URL on a non-standard host, AI review |
| openai-codex-desktop | parsiad | 11 | Medium | source=() URL on a non-standard host, AI review |
| pixeluvo | severach | 11 | Medium | External download from an untrusted host, not in source=(), source=() URL on a non-standard host, AI review |
| qqmusic-electron | sukanka | 11 | Medium | source=() URL on a non-standard host, AI review |
| ripcord-arch-libs | txtsd | 11 | Medium | source=() URL on a non-standard host, AI review |