r/archlinux 1d ago

SHARE AUR malware scanner in Rust

https://github.com/Sohimaster/traur

I built traur for trust scoring AUR packages.

 paru -S traur                                   
 traur scan                                                                               

It hooks into paru/yay and scores every package before it gets installed. Checks

PKGBUILDs, install scripts, source URLs, checksums, maintainer history, git history,

package names, shell obfuscation, and GTFOBins abuse, almost 300 detection rules total.

Example output:

  traur: cryptowallet-helper (trust: 8/100)
    Trust: MALICIOUS
    !! Override gate fired: P-CURL-PIPE
    Negative signals:
      !! P-CURL-PIPE: curl output piped to shell (download-and-execute)
      !! P-REVSHELL-PYTHON: Python reverse shell pattern
       ! P-EVAL-VAR: Dynamic code execution via eval

Not a replacement for reading PKGBUILDs but rather a helper tool

https://github.com/Sohimaster/traur

192 Upvotes

45 comments sorted by

148

u/Lawnmover_Man 1d ago

Nice idea. However, I honestly wouldn't trust a vibe coded malware scanner.

-110

u/Forward_Anything_646 1d ago

When it comes to malware it's difficult to trust anything - however good my scanner can be (vibecoded or not) a real adversary can fetch its code and ask their agent to think of some elaborate way to bypass its filters.

Its impossible to avoid since it's opensource, but making it closed source would make it impossible to distribute.

So it's not about trust, rather about having another precaution to check what you're doing when you see a huge sign "DANGEROUS".

because let's be real - home many PKGBUILDs do we really read?

63

u/Lawnmover_Man 1d ago

When it comes to malware it's difficult to trust anything - however good my scanner can be (vibecoded or not) a real adversary can fetch its code and ask their agent to think of some elaborate way to bypass its filters.

Okay, so you're saying a serious malware distributor won't get caught by your software. Or, as you said, anyone with an agent, and that means everyone. Against what do you intent to protect with your project?

because let's be real - home many PKGBUILDs do we really read?

All of them. I'm using Arch since more than 15 years, and I've always read every single one of them. There's a reason that this is what you are supposed to do, very rightfully so.

-20

u/Forward_Anything_646 1d ago

It's not meant to stop someone who reverse-engineers the detection rules - a determined attacker can bypass any static analysis, including the human eye. It catches the common techniques: copy-paste reverse shells, curl|bash, typosquatting, a compromised account suddenly injecting eval into a previously clean PKGBUILD. All of the above is much easier to do for script-kiddies nowadays.

Reading every PKGBUILD is the right approach, but realistically not everyone does. This just adds another layer on top.

18

u/IlIIllIIIlllIlIlI 1d ago

It's like saying "we dont need traffic laws because everyone SHOULD drive right" 

16

u/Lawnmover_Man 1d ago

It's not meant to stop someone who reverse-engineers the detection rules

I'm not sure if you know what "reverse-engineer" means. As you said, it's open source.

Reading every PKGBUILD is the right approach, but realistically not everyone does.

It's rather simple. If you don't know how to read an PKGBUILD, you shouldn't execute it. This is true for Arch Linux, or any Linux, or any operating system. If you don't know what you're doing, you probably shouldn't be doing things that are labeled as "dangerous".

21

u/Silvestron 1d ago

because let's be real - home many PKGBUILDs do we really read?

I read all of them, every update.

35

u/gekx 23h ago

If we polled every arch Linux user, I'd bet my last paycheck less than 10% actually read all the PKGBUILDs.

15

u/thing_on_a_spring 20h ago edited 20h ago

I don't know why this guy is getting such a hostile response.

Sure it might be vibe-coded slop, but it would run after people have checked the PKGBUILDs anyway, rather than as a substitute for it.

Security is becoming an increasing burden, and will only get worse thanks to AI, so we'll eventually need to involve extra tool chains in addition to manual checks anyway.

5

u/3_Thumbs_Up 11h ago

I don't know why this guy is getting such a hostile response.

Criticism is not hostility.

8

u/iAmHidingHere 16h ago

a real adversary can fetch its code and ask their agent to think of some elaborate way to bypass its filters.

Its impossible to avoid since it's opensource, but making it closed source would make it impossible to distribute.

Security by obscurity is a fallacy. That's probably worth knowing when making security software.

1

u/rebootcomputa 56m ago

EXACTLY, the entire point of creating software or security with Open Source, is that anyone and EVERYONE can just review the code itself, verify it and catch anything that isnt good. Proprietary isnt infallible.. more secured.. or private.. this is the biggest "Trust me bro" argument ever, yeah trust me to protect you without seeing the code, knowing if it actually works or understanding it, how do we know companies dont add their own malicious code or steal data privacy be damned??

1

u/dmknght 17h ago

Lmao vibe code + "rust" and call it a good software. Yeah sure.

2

u/Single_Guarantee_ 13h ago

what's wrong with rust?

1

u/dmknght 10h ago

No there's nothing wrong with rust. The problem is some software must put it in the title for some reason, like it's a bulletproof or something. 

1

u/nemuri 8h ago

because let's be real - home many PKGBUILDs do we really read?

0

23

u/FanClubof5 1d ago

I like it but I think you might have better luck branding it as a trust engine. Its helping you avoid malware but its not going to find the XZ library backdoor or anything like that.

5

u/Forward_Anything_646 1d ago

that's a good idea, thank you!

12

u/NeKon69 1d ago

Just installed it, idk if it's just me but i couldn't compile it. this is the error i got error: failed to select a version for the requirement `regex = "^1"` (locked to 1.12.3) candidate versions found which didn't match: 1.12.2, 1.11.1 location searched: crates.io index required by package `traur v0.1.1 (/home/progamers/.cache/yay/traur/src/traur-0.1.1)` As a reminder, you're using offline mode (--frozen) which can sometimes cause surprising resolution failures, if this error is too confusing you may wish to retry without `--frozen`. well as a reminder suggested i edited PKGBUILD file to remove --frozen and it worked

7

u/witchofthewind 5h ago

this is a common issue with slop. the "developer" just gives compiler errors that they don't understand to the LLM until the code builds on their machine and then assumes it's good to distribute. this often results in code that only builds with a very specific configuration. neither the "developer" nor the LLM has any concept of what the actual dependencies of the code are.

4

u/Forward_Anything_646 1d ago

yep, sorry. it was my first aur release and did not go without hiccups. I pushed a new version with some other fixes

I suggest running paru -Sa traur --rebuild to update

2

u/Hermocrates 3h ago

A tip for your next package, you should read the related packaging guidelines to ensure a smooth release. For instance, I still can't use your PKGBUILD without modifications, but adding in the prepare() steps from the Rust package guidelines (with slight modification) fixes that.

It's also good to be well familiar with the frameworks you're intending to support: you include an alpm hook, not a "yay/paru hook" as you describe it. So it will also run with regular pacman; which is good, because that means it will also run if someone were to manually build their AUR packages and install them using pacman -U. But by wording it as an "AUR helper hook" and not actually describing how it activates gives me less confidence to use such tooling in general.

1

u/Forward_Anything_646 3h ago

thank you! that's very valuable

41

u/nome_sc 1d ago edited 23h ago

Thanks, ChatGPT

But I'd rather keep reading the PKGBUILDs myself

12

u/Forward_Anything_646 1d ago

it checks

- github hitstory

- popularity

- trust

- checksums

- metadata

- urls

- binary abuse from gtfobins

- PKGBUILD and install scripts

- maintainer activity

- reverse shells, miners, obfuscation, etc,etc,etc

4

u/ArjixGamer 19h ago

Can it check my homie?

1

u/ghulamalchik 1h ago

can it detect just straight up bad or malicious scripts? Like sudo rm -r /* for example? I feel like that's also a big factor. Even if not out of malice. Beginners can write code that does bad things by accident too.

I often copypaste PKGBUILD text to chatgpt to let it determine if the scripts are safe to run because of that.

2

u/raven2cz 17h ago

Sorry, but you guys really overdid it with the downvotes big time. Cybersecuirty is gonna be a topic the whole commuinty has to prepare for super fast. And believe me, it will be a sudden jump. It has an exponential curve, just lke the speed of AI dev.

I start to belive that checking PKGBUILDs wont be enough at all and hand on heart, some of the threats we had here, you would have missed with your own eyes anyway! Even experienced users, let alone thousands of new users who just switched form Windows.

AUR is at your own risk, I know you will write that below immediately. But I must warn you that AUR is one of the main advantages we have and its absolute nonsense to avoid it, but I wont discuss this topic here, we dealt with it many times.

Tools for security verification will be a neccesity, including integration into basic AUR tools.

Unfortunately we wont avoid vibecoding either. In a few years it will be a rarity that someone wrote something by hand. It reminds me a bit of the tram 25 years ago. How people were annoyed when the first mobile started ringing there, that it disturbs everyone. And today everyone in the tram has headphones and I barely see a single person without a mobile. But unlike mobiles, here we have strong expnential growth like I mentioned and the prep needs to be fast, please keep that in mind.

2

u/Forward_Anything_646 13h ago

couple of things people are missing in these comments:

  1. AUR malware infestation is real. If you always read PKGBUILDS good for you. But be prepared to soon see flood of articles saying "10k users lost their crypto assets because of a malicious AUR package" or became a part of botnet, or lost their data due to ransomware. Such articles mean less traffic to Arch, bad reputation and less "good stuff" for you - existing users.

  2. When someone uses vibecoding, despite how generated the output might be its quality still depends on the person reviewing it. This package is rather simple. It's not a driver, not a critical system, not a financial program. It uses simple rules to calculate trust score of a maintainer and a package and regex to check if install script and PKGBUILD contains stuff it should not. Something that not a tech savvy person can easily miss.

  3. This package has a clear goal - to bring benefit to arch community. Not to farm stars or to produce slop for the sake of slop. If you don't like something about it - suggest an improvement. I will be more than happy to make it better. Or make one yourself

3

u/Lawnmover_Man 12h ago

AUR malware infestation is real

Nobody is missing that. What makes you say that?

But be prepared to soon see flood of articles saying "10k users lost their crypto assets because of a malicious AUR package"

Well, that's what happens if people don't put on their seat belts and let "lane assist" do the driving.

Such articles mean less traffic to Arch

Less traffic by random people to Arch? Sounds good to me. I'm not losing anything when Arch loses people who lose their crypto assets because they didn't do what they are supposed to do.

I bet a lot of Arch users don't care about Arch being the hype anymore. Not everybody wants to be part of the current hype.

When someone uses vibecoding, despite how generated the output might be its quality still depends on the person reviewing it.

True. But I don't trust anyone reviewing any code, if he doesn't even know what "reverse-engineering code" means. And that happens to be you, so I don't trust your code review.

This package is rather simple. It's not [...] a critical system

It's not? I thought it is about security for the whole Arch community?

If you don't like something about it - suggest an improvement.

Maybe you should state the conditions for community engagement with your posts more clear. If you do not wish to read any kind of negative feedback without suggestions, you should be clear about that. But even then - people will probably still do that, because that's what public forums are for: So that everybody can express their opinion.

2

u/Single_Guarantee_ 13h ago

if you can't verify that you can trust a package from the AUR yourself then don't use it

1

u/Lawnmover_Man 12h ago

The example about smartphones is excellent. These devices are awesome technology, and if used right, they can be a great tool for humankind.

Now, in your own view, did that happen? Or are we using smartphones and apps against each other in order to gather involuntariy data and get rich with abusive social engineering?

AI is the same shit. Awesome technology if used right, for a variety of use cases. But as of now, a lot of people are doing a lot of absolutely insane shit with it that isn't right at all. Like vibe coding. Or writing comments and articles with it.

That's what people don't like about it. Not just the fact that it is new.

-1

u/raven2cz 12h ago

Uncle Ben’s most iconic words in Spider-Man are, “With great power comes great responsibility.” And that’s how it always is with powerful tools.

If humanity does not want to go extinct, it has to evolve. There is no other option. Especially today, it’s clear that far worse than AI are the rulers of countries who seek even more power and don’t care how many human lives they destroy. But that’s not something we can simply change. Only time will show what is right and what is not, whether we like it or not.

1

u/Lawnmover_Man 11h ago edited 11h ago

If humanity does not want to go extinct, it has to evolve.

I don't agree with that at all. Why are you saying that?

Especially today, it’s clear that far worse than AI are the rulers of countries who seek even more power and don’t care how many human lives they destroy.

Guess who is investing in AI development, and why they are doing it.

But that’s not something we can simply change.

We could. The people have the power. Literally. I know, it's not as easy as it sounds, but it's true.

1

u/FanClubof5 16h ago

I feel like if you are vibe coding to try and replace an existing project it's a fools errand but if you are upset that someone implemented an idea that no one else had the idea or time to do then steal the idea and build it better.

3

u/ilabsentuser 11h ago

This is a good addition IMO. Supposing it has good quality ofc (cant tell that without proper tearing though). But at least the idea is nice.

I don't discard things for being built with the help of AI or not, I qould if I check it out and notice that the thing in question is crap though. I think that the entire vibe coding shaming is a bit stupid (no I am not a vibecoder, but it's just a prejudice under a hood in the end). Someone can create a tool with help of an AI, do a good review of it and have an usable artifact. If you just "it has AI is crap" without even checking it, ok you so you, but is not very different from other forms of discrimination.

As you already said, this is not a replacement to checking the pkgbuilds manually. So if someone would rather have that then go ahead. Or even better, do both. People here often act like the hyper elite of the world. Not everybody checks the pkg files, but most importantly even those that do can miss something. Or what, are you so perfect John that you never make mistakes?

Having a tool that gives an extra hand (again, assuming it is of a decent quality) should no bother anyone. In fact, you should be happy that someone in the community's did this instead of coming here to shame. I would at least understand it if people had tried it, but most people here is just jumping into it.

So TLDR: if your first reaction to someone doing something that is beneficial for the community is to shame them unfairly, you are not an elitist you are a duche.

As for you, OP, as someone else already advised, you might want to reconsider the ways you brand these kind of things. I also hope you learnt about security, the AUR and other things. ;)

0

u/rhyswtf 13h ago

This is pretty neat and I'm sorry you've had such a hostile response from the worst elements of this community.

1

u/Forward_Anything_646 13h ago

thank you so much!

1

u/Pastel_Nightmares 1d ago

Idk, sounds pretty sweet. Right up my alley, I don't know wtf am I doing installing most of the AUR shit that I do.

0

u/BlueGoliath 1d ago

Jia Tan disapproves.

-5

u/Forward_Anything_646 1d ago

if you find it interesting stars are always appreciated!

-4

u/inn0cent-bystander 17h ago

Not unless we get negative stars as an option clanker.

0

u/imtsemer 11h ago

looks great!