aur-malware-check-git
LOW
maintainer dreieck
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
Builds from the project's own GitHub repository (lenucksi/aur-malware-check); the only non-standard element is a local bundled shell script 'aur-malware-check.sh' with a pinned sha256 checksum, which is normal AUR packaging practice and not fetched from a remote untrusted host at build time.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Builds from the project's own GitHub repository (lenucksi/aur-malware-check); the only non-standard element is a local bundled shell script 'aur-malware-check.sh' with a pinned sha256 checksum, which is normal AUR packaging practice and not fetched from a remote untrusted host at build time.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:42
"${_gitname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: dreieck (https://aur.archlinux.org/account/dreieck)
2
3
_pyname="aur_check"
4
_gitname="aur-malware-check"
5
_pkgname="aur-malware-check"
6
pkgname="${_pkgname}-git"
7
pkgver=5.3.0.r109.20260707.9023c17
8
pkgrel=1
9
pkgdesc="Detection tools for the June 2026 atomic-lockfile AUR supply-chain attack and maybe other comprimised AUR packages. Consolidated from community Gists. Having this tool reporting nothing does not mean you are safe!"
10
arch=(
11
'any'
12
)
13
_githost='github.com'
14
_gituser='lenucksi'
15
url="https://${_githost}/${_gituser}/${_gitname}"
16
license=("GPL-3.0-only")
17
depends=(
18
'python>=3.14'
19
)
20
makedepends=(
21
'git'
22
)
23
optdepends=(
24
"${_pkgname}-pacman-hook: To invoke the check script at each pacman installation." # See https://github.com/lenucksi/aur-malware-check/tree/master/integration/pacman-hook if anyone wants to build a package containing the hook.
25
"${_pkgname}-systemd: Systemd service for continuous monitoring." # See https://github.com/lenucksi/aur-malware-check/tree/master/integration/systemd if anyone wants to build a package containing this service.
26
)
27
checkdepends=()
28
provides=(
29
"aur-check=${pkgver}" # Because there is the AUR package 'aur-check' (https://aur.archlinux.org/packages/aur-check).
30
"${_pkgname}=${pkgver}"
31
"python-${_pyname}=${pkgver}"
32
"python-${_pyname}-git=${pkgver}"
33
)
34
conflicts=(
35
"aur-check" # Because there is the AUR package 'aur-check' (https://aur.archlinux.org/packages/aur-check).
36
"${_pkgname}"
37
"python-${_pyname}"
38
"python-${_pyname}-git"
39
)
40
41
source=(
42
"${_gitname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
43
"aur-malware-check.sh"
44
)
45
sha256sums=(
46
'SKIP' # Main upstream source
47
'df9ae735e2e3681c4c94f5d188437599ab8469cbd6b1798bd7deb452b353097e' # aur-malware-check.sh
48
)
49
50
prepare() {
51
cd "${srcdir}/${_pkgname}"
52
git log > "${srcdir}/git.log"
53
}
54
55
pkgver() {
56
cd "${srcdir}/${_pkgname}"
57
58
_ver="$(git describe --tags | sed -E -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
59
_rev="$(git rev-list --count HEAD)"
60
_date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
61
_hash="$(git rev-parse --short HEAD)"
62
63
if [ -z "${_ver}" ]; then
64
error "Version could not be determined."
65
return 1
66
else
67
printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
68
fi
69
}
70
71
package() {
72
cd "${srcdir}/${_pkgname}"
73
74
local _pysitepkgdir="$(python -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')"
75
install -dvm755 "${pkgdir}/${_pysitepkgdir}"
76
cp -rv aur_check "${pkgdir}/${_pysitepkgdir}"/
77
78
install -dvm755 "${pkgdir}/usr/lib/aur_check"
79
cp -rv data "${pkgdir}/usr/lib/aur_check"/
80
81
install -Dvm755 "${srcdir}/aur-malware-check.sh" "${pkgdir}/usr/bin/aur-malware-check"
82
83
_docfiles=(
84
"${srcdir}/git.log"
85
README.md
86
CHANGELOG.md
87
DEVELOPING.md
88
SOURCES.md
89
)
90
_docdirs=()
91
_manfiles=()
92
_infofiles=()
93
_licensefiles=(
94
LICENSE
95
)
96
printf '%s\n' " --> installing documentation ..."
97
for _docfile in "${_docfiles[@]}"; do
98
install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docfile}")"
99
done
100
for _docdir in "${_docdirs[@]}"; do
101
cp -rv "${_docdir}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docdir}")"
102
done
103
for _manfile in "${_manfiles[@]}"; do
104
_section="$(basename "${_manfile}" .gz | sed -E -e 's|^.*\.([^.]*)$|\1|')"
105
install -D -v -m644 "docs/build/man/${_manfile}" "${pkgdir}/usr/share/man/man${_section}/$(basename "${_manfile}")"
106
done
107
for _infofile in "${_infofiles[@]}"; do
108
install -D -v -m644 "${_infofile}" "${pkgdir}/usr/share/info/$(basename "${_infofile}")"
109
done
110
printf '%s\n' " --> installing license ..."
111
for _licensefile in "${_licensefiles[@]}"; do
112
install -D -v -m644 "${_licensefile[@]}" "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")"
113
ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_licensefile}")"
114
done
115
}
116
117
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |