aurguard — AUR package security guard

# Why

AUR helpers happily run untrusted build code as your user — and .install scriptlets as root. A typo-squatted package, a hijacked maintainer account, or a single curl … | sh line is all it takes. aurguard puts a review step in front of that.

🧬

Clone-first, TOCTOU-safe

The repo is cloned once, then the same tree is analyzed and built — no swap between what you read and what runs.

🌳

Real bash parsing

A tree-sitter-bash AST sees eval and pipe-into-shell through quoting tricks, comments, and here-docs.

🚫

Never executes

Analysis is purely static. A clean report means “no known-bad shapes,” and nothing in the package has run.

# Why isn't aurguard published on the AUR itself?

Short answer: timing. In June 2026, the AUR suffered a large-scale supply-chain attack — 400+ community packages were hijacked and turned into a malware delivery network (credential-stealing payloads, in some cases rootkit-like persistence) — and Arch temporarily locked down new AUR account registration while cleaning it up. Publishing a security tool into that repository in the middle of that incident isn't something we're comfortable doing until the AUR's own incident response has fully run its course. Build-from-source (install.sh), cargo install aurguard, and npm install -g aurguard all work today regardless — see Install.

Arch Linux's own incident notice (published 2026-06-12), quoted in full:

We are currently experiencing a high volume of malicious package adoption and updates in the Arch User Repository. We are actively working to track existing malicious commits and to prevent additional malicious commits from being pushed. While this is happening, and while we work to build a more permanent solution, users may experience issues with: creating new accounts on the AUR, forcing package updates, and adoption or creation of new packages. We continue to encourage all users of AUR packages to review the entire PKGBUILD and to inspect install scripts, especially while updating during this period. If you notice suspicious commits on a package you use, please reach out to Arch staff via the aur-general mailing list with further information.
— Arch Linux — Active AUR malicious packages incident

For the current status and any follow-up notices, see the AUR itself: aur.archlinux.org.

Türkçe

Kısa cevap: zamanlama. Haziran 2026'da AUR, büyük çaplı bir tedarik zinciri saldırısına uğradı — 400'den fazla topluluk paketi ele geçirilip bir kötü amaçlı yazılım dağıtım ağına dönüştürüldü (bazı durumlarda kimlik bilgisi çalan yükler, rootkit benzeri kalıcılık mekanizmaları dahil) — ve Arch bu temizlik sürerken AUR'a yeni hesap kaydını geçici olarak durdurdu. Bu olay tam ortasındayken bir güvenlik aracını aynı depoya yayınlamak, AUR'un kendi olay müdahalesi tamamen sonuçlanana kadar rahat hissettiğimiz bir şey değil. Kaynaktan kurulum (install.sh), cargo install aurguard ve npm install -g aurguard bugün hiçbir kısıtlama olmadan çalışıyor — bkz. Install.

Şu anda Arch User Repository'de yüksek miktarda kötü amaçlı paket benimseme ve güncellemesi yaşıyoruz. Mevcut kötü niyetli commit'leri takip etmek ve ek kötü niyetli commit'lerin gönderilmesini önlemek için aktif olarak çalışıyoruz. Bu yaşanırken ve daha kalıcı bir çözüm oluşturmaya çalışırken, kullanıcılar şu konularda sorun yaşayabilir: AUR'da yeni hesap oluşturma, paket güncellemelerini zorlama, yeni paketlerin sahiplenilmesi veya oluşturulması. AUR paketi kullanan herkesi, özellikle bu dönemde güncelleme yaparken tüm PKGBUILD'ı incelemeye ve kurulum betiklerini gözden geçirmeye teşvik etmeye devam ediyoruz. Kullandığınız bir pakette şüpheli commit'ler fark ederseniz, lütfen daha fazla bilgiyle aur-general posta listesi üzerinden Arch ekibine ulaşın.
— Arch Linux — Aktif AUR kötü amaçlı paket olayı

Güncel durum ve olası takip bildirimleri için AUR'un kendisine bakın: aur.archlinux.org.

# What it checks

Twelve analysis passes feed one report: a tree-sitter-bash AST pass, textual heuristics, a 24-rule YARA-style signature database (plus an updatable rules.d/ overlay), recursive decoding, anti-evasion normalization, dataflow taint, IOC/wallet matching, committed-binary + VirusTotal checks, a source-tree text scan over every build-helper script, PGP/pkgver() integrity, and package metadata & history.

🔎

24 YARA-style signatures

A dependency-free rule engine matches named malware shapes — miners, exfiltration, persistence, defense-evasion, container escape, cloud-metadata SSRF, reverse shells — with vetoes that stay quiet on legitimate $pkgdir packaging. Extend it with your own rules in config.

🧬

Anti-evasion decoding

Recursively decodes nested base64/hex, folds b""ash / ${IFS} / $'\x65' tricks, reverses rot13 / reversed / URL-encoded strings, and flags base64-wrapped gzip/ELF payloads — then re-runs every signature over what it finds.

🩸

Dataflow taint

Connects untrusted input to execution across lines: a captured $(curl …) or a downloaded file reaching eval, sh -c, a here-string, or source — the split-fetch-then-run trick that single-line rules miss.

🧪

Committed binaries & VirusTotal

Prebuilt executables checked into a package tree are flagged and SHA-256-hashed. Check them on VirusTotal — offline by hash + link, or via the API with --vt. Nothing is ever uploaded.

🌐

Source & metadata

Insecure/IP/shortened source URLs, SKIP checksums, untrusted git clone, maintainer age, low votes, staleness, and pkgrel churn.

🔐

Root scriptlets

.install hooks run as root, so they get the full rule set plus a flag for any network access at install time.

📜

Source-tree text scan

Malware doesn't have to live in the PKGBUILD. Every *.sh, *.py, *.js, Makefile, build.rs, and unreferenced .install file in the cloned tree gets the same AST + signature + decode + taint treatment, attributed by path:line.

🔄

Updatable ruleset

aurguard --update-rules fetches a versioned TOML signature set over HTTPS, validates it before touching disk, and never downgrades. Layer your own rules in rules.d/ without recompiling.

📝

Approval ledger

Approve a PKGBUILD once; aurguard surfaces silent upstream edits on the next install via a content digest.

⏿

Scriptable

--json output and exit codes (0/10/20) make it a clean CI gate.

🗣️

Five languages

Interface and findings localized end to end.

English Türkçe Français Español Azərbaycan

# A sample of the rules

Findings are bucketed INFO · WARN · CRITICAL; a package's risk is the highest severity it trips. CRITICAL is blocked by default.

CURL_PIPE_SH REVERSE_SHELL CRYPTO_MINER DISCORD_EXFIL CRED_HARVEST SSH_KEY_INJECT CRON_PERSIST DECODED_THREAT COMPRESSED_PAYLOAD TAINTED_EXEC PKGVER_EXEC COMMITTED_BINARY IOC_MATCH VT_FLAGGED LD_PRELOAD_HIJACK CLOUD_METADATA DOCKER_SOCK SUDOERS_TAMPER PY_REVERSE_SHELL DESTRUCTIVE EVASION_NORMALIZED WALLET_ADDRESS MISSING_PGP MAINTAINER_CHANGED DELTA_NEW_RISK ORPHAN_PACKAGE FLAGGED_OUTDATED UNKNOWN_SOURCE TOR_C2 PIP_INDEX_HIJACK WEBHOOK_EXFIL_GENERIC CURL_BASH_PROCSUB CUSTOM_RULE

…and more — 24 signature rules plus the heuristic, decode, taint, metadata, and integrity passes. Add your own rules and IOC lists in config.toml.

# Install

Linux only — the AUR is Arch-specific.

From source (recommended)

# needs the Rust toolchain + a C compiler (tree-sitter-bash grammar)
git clone https://github.com/lunanoir21/aurguard-project.git
cd aurguard-project
cargo build --release
./target/release/aurguard --setup

From npm

npm install -g aurguard

The npm package is a thin launcher with no install script. The prebuilt binary ships as a platform-specific optional dependency, so nothing is downloaded or executed at install time — no postinstall, no remote-code surface, zero runtime dependencies.

From crates.io

cargo install aurguard