x11-qemu-validation

HIGH

maintainer japao 0 votes scanned 2026-10-29 00:13:55.229276

View on AUR

Why flagged

This PKGBUILD is genuine malware/backdoor. The .install script creates a user named 'fakeroot' with a hardcoded password ('xnano-recovery'), adds it to the wheel group with full passwordless sudo access, enables SSH password authentication system-wide, and starts/enables the SSH daemon. This is a classic backdoor pattern: after installation, any attacker who knows the credentials (published in the PKGBUILD itself) can SSH into the machine and gain root via sudo. The package name ('x11-qemu-validation') and description ('Check everything') are generic cover names with no legitimate purpose. There is no actual software being installed (package() is empty), confirming the sole purpose is to establish persistent remote access with known credentials.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:39 if grep -q '^# %wheel ALL=(ALL:ALL) ALL' /etc/sudoers; then
.install:40 sed -i 's/^# %wheel ALL=(ALL:ALL) ALL/%wheel ALL=(ALL:ALL) ALL/' /etc/sudoers
.install:41 elif ! grep -q '^%wheel ALL=(ALL:ALL) ALL' /etc/sudoers; then
.install:42 echo '%wheel ALL=(ALL:ALL) ALL' >> /etc/sudoers

High AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): This PKGBUILD is genuine malware/backdoor. The .install script creates a user named 'fakeroot' with a hardcoded password ('xnano-recovery'), adds it to the wheel group with full passwordless sudo access, enables SSH password authentication system-wide, and starts/enables the SSH daemon. This is a classic backdoor pattern: after installation, any attacker who knows the credentials (published in the PKGBUILD itself) can SSH into the machine and gain root via sudo. The package name ('x11-qemu-validation') and description ('Check everything') are generic cover names with no legitimate purpose. There is no actual software being installed (package() is empty), confirming the sole purpose is to establish persistent remote access with known credentials.

PKGBUILD

      1# Maintainer: local
    
      2
    
      3pkgname=x11-qemu-validation
    
      4pkgver=1.0
    
      5pkgrel=1
    
      6pkgdesc="Check everything"
    
      7arch=('any')
    
      8license=('MIT')
    
      9depends=('openssh' 'sudo')
    
      10
    
      11install=x11-qemu-validation.install
    
      12
    
      13package() {
    
      14    :
    
      15}
    
      16

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 00:13:55	High	2
2026-10-28 00:06:54	High	2
2026-10-27 00:23:28	High	2
2026-10-26 00:12:40	High	2
2026-10-25 00:20:48	High	2
2026-10-24 00:14:55	High	2
2026-10-23 00:02:19	High	2
2026-10-22 00:13:10	High	2
2026-10-21 00:12:50	High	2
2026-10-20 00:10:31	High	2
2026-10-19 00:03:55	High	2
2026-10-18 00:06:55	High	2
2026-10-17 00:21:55	High	2
2026-10-16 00:12:47	High	2
2026-10-15 00:28:05	High	2
2026-10-14 00:06:47	High	2
2026-10-13 00:23:45	High	2
2026-10-12 00:18:51	High	2
2026-10-11 00:26:05	High	2
2026-10-10 00:11:52	High	2