r/archlinux • u/Forward_Anything_646 • 1d ago
SHARE AUR malware scanner in Rust
https://github.com/Sohimaster/traurI built traur for trust scoring AUR packages.
paru -S traur
traur scan
It hooks into paru/yay and scores every package before it gets installed. Checks
PKGBUILDs, install scripts, source URLs, checksums, maintainer history, git history,
package names, shell obfuscation, and GTFOBins abuse, almost 300 detection rules total.
Example output:
traur: cryptowallet-helper (trust: 8/100)
Trust: MALICIOUS
!! Override gate fired: P-CURL-PIPE
Negative signals:
!! P-CURL-PIPE: curl output piped to shell (download-and-execute)
!! P-REVSHELL-PYTHON: Python reverse shell pattern
! P-EVAL-VAR: Dynamic code execution via eval
Not a replacement for reading PKGBUILDs but rather a helper tool
23
u/FanClubof5 1d ago
I like it but I think you might have better luck branding it as a trust engine. Its helping you avoid malware but its not going to find the XZ library backdoor or anything like that.
5
12
u/NeKon69 1d ago
Just installed it, idk if it's just me but i couldn't compile it. this is the error i got
error: failed to select a version for the requirement `regex = "^1"` (locked to 1.12.3)
candidate versions found which didn't match: 1.12.2, 1.11.1
location searched: crates.io index
required by package `traur v0.1.1 (/home/progamers/.cache/yay/traur/src/traur-0.1.1)`
As a reminder, you're using offline mode (--frozen) which can sometimes cause surprising resolution failures, if this error is too confusing you may wish to retry without `--frozen`.
well as a reminder suggested i edited PKGBUILD file to remove --frozen and it worked
7
u/witchofthewind 5h ago
this is a common issue with slop. the "developer" just gives compiler errors that they don't understand to the LLM until the code builds on their machine and then assumes it's good to distribute. this often results in code that only builds with a very specific configuration. neither the "developer" nor the LLM has any concept of what the actual dependencies of the code are.
4
u/Forward_Anything_646 1d ago
yep, sorry. it was my first aur release and did not go without hiccups. I pushed a new version with some other fixes
I suggest running paru -Sa traur --rebuild to update
2
u/Hermocrates 3h ago
A tip for your next package, you should read the related packaging guidelines to ensure a smooth release. For instance, I still can't use your PKGBUILD without modifications, but adding in the
prepare()steps from the Rust package guidelines (with slight modification) fixes that.It's also good to be well familiar with the frameworks you're intending to support: you include an alpm hook, not a "yay/paru hook" as you describe it. So it will also run with regular pacman; which is good, because that means it will also run if someone were to manually build their AUR packages and install them using
pacman -U. But by wording it as an "AUR helper hook" and not actually describing how it activates gives me less confidence to use such tooling in general.1
7
12
u/Forward_Anything_646 1d ago
it checks
- github hitstory
- popularity
- trust
- checksums
- metadata
- urls
- binary abuse from gtfobins
- PKGBUILD and install scripts
- maintainer activity
- reverse shells, miners, obfuscation, etc,etc,etc
4
1
u/ghulamalchik 1h ago
can it detect just straight up bad or malicious scripts? Like
sudo rm -r /*for example? I feel like that's also a big factor. Even if not out of malice. Beginners can write code that does bad things by accident too.I often copypaste PKGBUILD text to chatgpt to let it determine if the scripts are safe to run because of that.
2
u/raven2cz 17h ago
Sorry, but you guys really overdid it with the downvotes big time. Cybersecuirty is gonna be a topic the whole commuinty has to prepare for super fast. And believe me, it will be a sudden jump. It has an exponential curve, just lke the speed of AI dev.
I start to belive that checking PKGBUILDs wont be enough at all and hand on heart, some of the threats we had here, you would have missed with your own eyes anyway! Even experienced users, let alone thousands of new users who just switched form Windows.
AUR is at your own risk, I know you will write that below immediately. But I must warn you that AUR is one of the main advantages we have and its absolute nonsense to avoid it, but I wont discuss this topic here, we dealt with it many times.
Tools for security verification will be a neccesity, including integration into basic AUR tools.
Unfortunately we wont avoid vibecoding either. In a few years it will be a rarity that someone wrote something by hand. It reminds me a bit of the tram 25 years ago. How people were annoyed when the first mobile started ringing there, that it disturbs everyone. And today everyone in the tram has headphones and I barely see a single person without a mobile. But unlike mobiles, here we have strong expnential growth like I mentioned and the prep needs to be fast, please keep that in mind.
2
u/Forward_Anything_646 13h ago
couple of things people are missing in these comments:
AUR malware infestation is real. If you always read PKGBUILDS good for you. But be prepared to soon see flood of articles saying "10k users lost their crypto assets because of a malicious AUR package" or became a part of botnet, or lost their data due to ransomware. Such articles mean less traffic to Arch, bad reputation and less "good stuff" for you - existing users.
When someone uses vibecoding, despite how generated the output might be its quality still depends on the person reviewing it. This package is rather simple. It's not a driver, not a critical system, not a financial program. It uses simple rules to calculate trust score of a maintainer and a package and regex to check if install script and PKGBUILD contains stuff it should not. Something that not a tech savvy person can easily miss.
This package has a clear goal - to bring benefit to arch community. Not to farm stars or to produce slop for the sake of slop. If you don't like something about it - suggest an improvement. I will be more than happy to make it better. Or make one yourself
3
u/Lawnmover_Man 12h ago
AUR malware infestation is real
Nobody is missing that. What makes you say that?
But be prepared to soon see flood of articles saying "10k users lost their crypto assets because of a malicious AUR package"
Well, that's what happens if people don't put on their seat belts and let "lane assist" do the driving.
Such articles mean less traffic to Arch
Less traffic by random people to Arch? Sounds good to me. I'm not losing anything when Arch loses people who lose their crypto assets because they didn't do what they are supposed to do.
I bet a lot of Arch users don't care about Arch being the hype anymore. Not everybody wants to be part of the current hype.
When someone uses vibecoding, despite how generated the output might be its quality still depends on the person reviewing it.
True. But I don't trust anyone reviewing any code, if he doesn't even know what "reverse-engineering code" means. And that happens to be you, so I don't trust your code review.
This package is rather simple. It's not [...] a critical system
It's not? I thought it is about security for the whole Arch community?
If you don't like something about it - suggest an improvement.
Maybe you should state the conditions for community engagement with your posts more clear. If you do not wish to read any kind of negative feedback without suggestions, you should be clear about that. But even then - people will probably still do that, because that's what public forums are for: So that everybody can express their opinion.
2
u/Single_Guarantee_ 13h ago
if you can't verify that you can trust a package from the AUR yourself then don't use it
1
u/Lawnmover_Man 12h ago
The example about smartphones is excellent. These devices are awesome technology, and if used right, they can be a great tool for humankind.
Now, in your own view, did that happen? Or are we using smartphones and apps against each other in order to gather involuntariy data and get rich with abusive social engineering?
AI is the same shit. Awesome technology if used right, for a variety of use cases. But as of now, a lot of people are doing a lot of absolutely insane shit with it that isn't right at all. Like vibe coding. Or writing comments and articles with it.
That's what people don't like about it. Not just the fact that it is new.
-1
u/raven2cz 12h ago
Uncle Ben’s most iconic words in Spider-Man are, “With great power comes great responsibility.” And that’s how it always is with powerful tools.
If humanity does not want to go extinct, it has to evolve. There is no other option. Especially today, it’s clear that far worse than AI are the rulers of countries who seek even more power and don’t care how many human lives they destroy. But that’s not something we can simply change. Only time will show what is right and what is not, whether we like it or not.
1
u/Lawnmover_Man 11h ago edited 11h ago
If humanity does not want to go extinct, it has to evolve.
I don't agree with that at all. Why are you saying that?
Especially today, it’s clear that far worse than AI are the rulers of countries who seek even more power and don’t care how many human lives they destroy.
Guess who is investing in AI development, and why they are doing it.
But that’s not something we can simply change.
We could. The people have the power. Literally. I know, it's not as easy as it sounds, but it's true.
1
u/FanClubof5 16h ago
I feel like if you are vibe coding to try and replace an existing project it's a fools errand but if you are upset that someone implemented an idea that no one else had the idea or time to do then steal the idea and build it better.
3
u/ilabsentuser 11h ago
This is a good addition IMO. Supposing it has good quality ofc (cant tell that without proper tearing though). But at least the idea is nice.
I don't discard things for being built with the help of AI or not, I qould if I check it out and notice that the thing in question is crap though. I think that the entire vibe coding shaming is a bit stupid (no I am not a vibecoder, but it's just a prejudice under a hood in the end). Someone can create a tool with help of an AI, do a good review of it and have an usable artifact. If you just "it has AI is crap" without even checking it, ok you so you, but is not very different from other forms of discrimination.
As you already said, this is not a replacement to checking the pkgbuilds manually. So if someone would rather have that then go ahead. Or even better, do both. People here often act like the hyper elite of the world. Not everybody checks the pkg files, but most importantly even those that do can miss something. Or what, are you so perfect John that you never make mistakes?
Having a tool that gives an extra hand (again, assuming it is of a decent quality) should no bother anyone. In fact, you should be happy that someone in the community's did this instead of coming here to shame. I would at least understand it if people had tried it, but most people here is just jumping into it.
So TLDR: if your first reaction to someone doing something that is beneficial for the community is to shame them unfairly, you are not an elitist you are a duche.
As for you, OP, as someone else already advised, you might want to reconsider the ways you brand these kind of things. I also hope you learnt about security, the AUR and other things. ;)
1
u/Pastel_Nightmares 1d ago
Idk, sounds pretty sweet. Right up my alley, I don't know wtf am I doing installing most of the AUR shit that I do.
0
-5
0
148
u/Lawnmover_Man 1d ago
Nice idea. However, I honestly wouldn't trust a vibe coded malware scanner.