Carl, thank you for your e-mail. I believe that the silent majority of AUR users is in a similar position: we have some technical skills and would understand the problem when we get pointed on. But we neither have the time nor the forensic expertise to really understand in detail every aspect of every AUR package we re using.
There are some loud opinions of having everything under control by just reading every diff and I trust 100% that they are right. But for myself I can use some tooling, that pushes my nose into it: are@ryzen /r/m/a/M/aur-mirror (BARE:main )> env AURSCAN_RULES_ONLY=1 aurscan /tmp/hf </dev/null 2>&1 scanning hf (3 files) ... [ SUSP ] hf confidence 60% Static rules matched (static rules only (AURSCAN_RULES_ONLY)). Without a model these need review, not a verdict. [critical] PKGBUILD: PRIV-003 sudoers modification > install -Dm440 hyprland-fixes-permissions > /etc/sudoers.d/hyprland-fixes-permissions !! Installation blocked: 1 package(s) flagged SUSPICIOUS. And this was static/offline rules only (see AURSCAN_RULES_ONLY=1). With some additional help from Claude, it get easier to judge: are@ryzen /r/m/a/M/aur-mirror (BARE:main ) [1]> env aurscan /tmp/hf </dev/null 2>&1 scanning hf (3 files) ... [ MAL! ] hf confidence 93% 2 critical findings and 4 warnings indicate malicious behaviour; do not build. [critical] PKGBUILD: sudo/pkexec/setuid manipulation, sudoers edits, or a pacman hook the package installs for itself that runs code — Installs an unreviewed sudoers.d file from a personal repo; content unknown and could grant passwordless sudo to arbitrary commands. > install -Dm440 hyprland-fixes-permissions > "$pkgdir/etc/sudoers.d/hyprland-fixes-permissions" [critical] hyprland-fixes.install: An install scriptlet makes root- level system changes: drops a binary into a system bin directory, writes and enables a systemd unit, or invokes pacman — post_install runs an unreviewed binary from the package via sudo, as root, on the live system immediately after install. > /usr/bin/sudo /usr/bin/hyprland-fixes 1>/dev/null 2>/dev/null [warning] .SRCINFO: A source/download whose provenance the host cannot establish (generic object store, or a host unrelated to the stated upstream that is not a known forge) — Personal GitHub repo with nonsensical username and garbage maintainer email; no established upstream or reputation. > source = git+https://github.com/iusearch-hyprlandbtw/hyprland-fixes.git [warning] PKGBUILD: A recently adopted/orphaned/newly-active package that gains build- or install-time network or package-manager behaviour, or a maintainer-field mismatch — Garbage maintainer email, unknown personal repo, no reputation signals; package installs sudoers file and runs binary as root post-install. > # Maintainer: IUseArchHyprlandBtw > <[email protected]> [warning] PKGBUILD: The package references a file that was not supplied to the scanner (an install= scriptlet, a local source, a .hook or a .patch), so its behaviour could not be reviewed — Three files from the unreviewed git repo (hyprland-fixes, hyprland-windowrule-and-keybind-fixes, hyprland-fixes-permissions) are installed and executed but not supplied for review. > install -Dm755 hyprland-fixes ... install -Dm755 > hyprland-windowrule-and-keybind-fixes ... install -Dm440 > hyprland-fixes-permissions [warning] hyprland-fixes.install: Writes outside $srcdir/$pkgdir during build: $HOME, ~/.config, shell rc, systemd units, cron, udev, /etc outside fakeroot — The executed binary writes to the installing user's home directory (~/.config/hypr/), outside pkgdir/srcdir. > This puts a hyprland.lua configuration with path > ~/.config/hypr/hyprland.lua ↳ tokens: 4,438 in / 1,046 out · $0.0290 scanner usage: 1 call(s) · tokens: 4,438 in / 1,046 out · $0.0290 !! Installation blocked: 1 package(s) flagged MALICIOUS. Best and cheers! Andreas On Fri, 2026-08-28 at 20:51 -0400, Carl T. Miller wrote: > I have recently been reviewing PKGBUILD files and I'm still > in the learning phase. I tried to find the bad version of this > package so I can study what it does and how it does it. > > Apparently this version has been removed. How do I find > the original files? Or, if it's better, let me ask how did you > know there was a problem? > > c > > > On 8/28/26 4:02 PM, Saren wrote: > > This package contains a real config of hyprland but it blatantly > > opens > > up a backdoor for the attacker: > > > > Package URL: https://aur.archlinux.org/packages/hyprland-fixes > > > > Package source repo: > > https://github.com/iusearch-hyprlandbtw/hyprland-fixes > > > > Source repo snapshot: > > https://drop.wtako.net/file/22927ab5f074e4fafe959de72bb55db7768e1654.zip > > (password: "backdoor" [8 characters] > > >
