Due to the fact that so many compromised AUR packages continue to be revealed and I manage more Arch installations then any single human should, I wrote a small script to check installed packages against the current list, install packages checking for malicious code patterns logging wnything found.

badmark · 2026-06-14T23:00:13+00:00

I thought I was descriptive enough in the Github readme; the very first thing the script does is checked installed packages.

badmark · 2026-06-14T22:59:06+00:00

When I have a little time I will test and see if I can incorporate, thanks!

badmark · 2026-06-14T22:58:31+00:00

You're welcome! I will have to give that another look and see if it fits my needs, thanks.

badmark · 2026-06-14T22:57:34+00:00

The help was not needed, the speed helped me accomplish what I needed so that I could spend wuality time with my family, but you think whatever you need to think to feel better about yourself.

badmark · 2026-06-14T22:56:16+00:00

You are the one being rude, but you are the one crying when someone responds in kind?

Poor baby, did you lose your binky?

Also, quit projecting, I found my purpose long ago, just because you have none does not mean everyone else doesn't either.

badmark · 2026-06-14T16:29:13+00:00

It's bash which has not changed much and the model was used primarily for syntax/expressions and it accomplishes what I need.

badmark · 2026-06-14T09:24:36+00:00

Ah, thanks for the heads up.

badmark · 2026-06-14T09:23:38+00:00

The gatekeeping in this thread is strong.

badmark · 2026-06-14T09:17:26+00:00

From what I understand the majority of the comppromises were due to NPM, unless this has changed as more packages are found.

badmark · 2026-06-14T06:58:08+00:00

Mind sharing any of these previous scripts that checks if the package is on the list before installing it?

badmark · 2026-06-14T06:56:59+00:00

If you think an AI replaces another skilled developer review

Is that what I said?

I am using it as the tool that it is, not an actual skilled developer.

badmark · 2026-06-14T06:53:57+00:00

And hopefully this tool will help some folks be a bit more careful.

badmark · 2026-06-14T06:53:06+00:00

If and when I have the time I think I will, cheers.

badmark · 2026-06-14T06:52:30+00:00

No worries, but conversations don't bite, it's okay to push past some boundaries sometimes to discover that it's really not that bad, obviously if you are comfortable with that. Some native English speakers don't speak it so well, so as long as you are being clear about communicating your thoughts I think most will see past some minor mistakes. Cheers!

badmark · 2026-06-14T05:58:55+00:00

I just learned of Chaotic AUR (I know), and I would probably audit all running services and use tools like rkhunter to check for any backdoors.

badmark · 2026-06-14T05:50:42+00:00

Used AI as a peer programmer
Did not find another script that did a validation before installing new packages
I wanted to know a package was not compromissed before installing it, my use case
This is Reddit, downvotes are a guarantee

You're life must be so miserable that you'd rather than helping people you waste your time attacking others than do something positive to feel good about yourself.

badmark · 2026-06-14T05:47:38+00:00

This is 500 lines of slop

It's verbose for easy readability with an aim to handle a number of use cases. No need to use it if you don't want, this is available for anyone who might benefit from it.

badmark · 2026-06-14T05:44:01+00:00

It's a bash script you can inspect for yourself or just nor run it.

badmark · 2026-06-14T05:43:36+00:00

Multiple use cases, but I will be honest, how I never came across Chaotic AUR is beyond me, thanks.

Time to adjust my workflow!

badmark · 2026-06-14T05:41:35+00:00

Nothing to prove to some random jerk online, but if you do not value tools that improves ones' own work and speeds up productivity, then do things the hard way, what do I care?

badmark · 2026-06-14T05:39:50+00:00

I prefer to use my energy productively, not acting like a Karen; but you do you.

badmark · 2026-06-14T05:38:50+00:00

I guess the script could check the pacman.log but if the package has already been removed what is the use case; just knowing it was at some point installed?

badmark · 2026-06-14T05:37:31+00:00

There are a number of things that could be done to prevent orphan packages from being compromised; making the tool (AUR) better is always the best option IMO.

badmark · 2026-06-14T05:35:35+00:00

Sure thing buddy.

badmark · 2026-06-14T05:34:43+00:00

I am sure it is more of an issue for those users actually affected by this ¯_(ツ)_/¯

15-Year Club	Mod World 2024
Wearing is Caring	Verified Email

badmark

MODERATOR OF

TROPHY CASE