x11-qemu-validation

HIGH

maintainer japao 0 votes scanned 2026-09-14 09:19:59.375854

View on AUR

Why flagged

This PKGBUILD is genuine malware/backdoor. The .install script creates a user named 'fakeroot' with a hardcoded password ('xnano-recovery'), adds it to the wheel group with full passwordless sudo access, enables SSH password authentication system-wide, and starts/enables the SSH daemon. This is a classic backdoor pattern: after installation, any attacker who knows the credentials (published in the PKGBUILD itself) can SSH into the machine and gain root via sudo. The package name ('x11-qemu-validation') and description ('Check everything') are generic cover names with no legitimate purpose. There is no actual software being installed (package() is empty), confirming the sole purpose is to establish persistent remote access with known credentials.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:39 if grep -q '^# %wheel ALL=(ALL:ALL) ALL' /etc/sudoers; then
.install:40 sed -i 's/^# %wheel ALL=(ALL:ALL) ALL/%wheel ALL=(ALL:ALL) ALL/' /etc/sudoers
.install:41 elif ! grep -q '^%wheel ALL=(ALL:ALL) ALL' /etc/sudoers; then
.install:42 echo '%wheel ALL=(ALL:ALL) ALL' >> /etc/sudoers

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

High AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is HIGH (confidence 95%): This PKGBUILD is genuine malware/backdoor. The .install script creates a user named 'fakeroot' with a hardcoded password ('xnano-recovery'), adds it to the wheel group with full passwordless sudo access, enables SSH password authentication system-wide, and starts/enables the SSH daemon. This is a classic backdoor pattern: after installation, any attacker who knows the credentials (published in the PKGBUILD itself) can SSH into the machine and gain root via sudo. The package name ('x11-qemu-validation') and description ('Check everything') are generic cover names with no legitimate purpose. There is no actual software being installed (package() is empty), confirming the sole purpose is to establish persistent remote access with known credentials.

PKGBUILD

      1# Maintainer: local
    
      2
    
      3pkgname=x11-qemu-validation
    
      4pkgver=1.0
    
      5pkgrel=1
    
      6pkgdesc="Check everything"
    
      7arch=('any')
    
      8license=('MIT')
    
      9depends=('openssh' 'sudo')
    
      10
    
      11install=x11-qemu-validation.install
    
      12
    
      13package() {
    
      14    :
    
      15}
    
      16

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-14 09:19:59	High	3
2026-09-14 09:16:46	High	3