Carl,

thank you for your e-mail. I believe that the silent majority of AUR
users is in a similar position: we have some technical skills and would
understand the problem when we get pointed on. But we neither have the
time nor the forensic expertise to really understand in detail every
aspect of every AUR package we re using.

There are some loud opinions of having everything under control by just
reading every diff and I trust 100% that they are right. But for myself
I can use some tooling, that pushes my nose into it:

are@ryzen /r/m/a/M/aur-mirror (BARE:main )> env AURSCAN_RULES_ONLY=1
aurscan /tmp/hf </dev/null 2>&1
scanning hf (3 files) ...

[ SUSP ] hf confidence 60%
Static rules matched (static rules only (AURSCAN_RULES_ONLY)). Without
a model
these need review, not a verdict.
[critical] PKGBUILD: PRIV-003 sudoers modification
> install -Dm440 hyprland-fixes-permissions
> /etc/sudoers.d/hyprland-fixes-permissions

!! Installation blocked: 1 package(s) flagged SUSPICIOUS.

And this was static/offline rules only (see AURSCAN_RULES_ONLY=1).

With some additional help from Claude, it get easier to judge:

are@ryzen /r/m/a/M/aur-mirror (BARE:main ) [1]> env aurscan /tmp/hf
</dev/null 2>&1
scanning hf (3 files) ...

[ MAL! ] hf confidence 93%
2 critical findings and 4 warnings indicate malicious behaviour; do not
build.
[critical] PKGBUILD: sudo/pkexec/setuid manipulation, sudoers edits, or
a
pacman hook the package installs for itself that runs
code — Installs an unreviewed sudoers.d file from a
personal repo; content unknown and could grant
passwordless sudo to arbitrary commands.
> install -Dm440 hyprland-fixes-permissions
> "$pkgdir/etc/sudoers.d/hyprland-fixes-permissions"
[critical] hyprland-fixes.install: An install scriptlet makes root-
level
system changes: drops a binary into a
system bin directory, writes and enables a
systemd unit, or invokes pacman —
post_install runs an unreviewed binary from
the package via sudo, as root, on the live
system immediately after install.
> /usr/bin/sudo /usr/bin/hyprland-fixes 1>/dev/null 2>/dev/null
[warning] .SRCINFO: A source/download whose provenance the host cannot
establish (generic object store, or a host unrelated to
the stated upstream that is not a known forge) — Personal
GitHub repo with nonsensical username and garbage
maintainer email; no established upstream or reputation.
> source =
git+https://github.com/iusearch-hyprlandbtw/hyprland-fixes.git
[warning] PKGBUILD: A recently adopted/orphaned/newly-active package
that
gains build- or install-time network or package-manager
behaviour, or a maintainer-field mismatch — Garbage
maintainer email, unknown personal repo, no reputation
signals; package installs sudoers file and runs binary as
root post-install.
> # Maintainer: IUseArchHyprlandBtw
> <[email protected]>
[warning] PKGBUILD: The package references a file that was not supplied
to the
scanner (an install= scriptlet, a local source, a .hook or
a .patch), so its behaviour could not be reviewed — Three
files from the unreviewed git repo (hyprland-fixes,
hyprland-windowrule-and-keybind-fixes,
hyprland-fixes-permissions) are installed and executed but
not supplied for review.
> install -Dm755 hyprland-fixes ... install -Dm755
> hyprland-windowrule-and-keybind-fixes ... install -Dm440
> hyprland-fixes-permissions
[warning] hyprland-fixes.install: Writes outside $srcdir/$pkgdir during
build:
$HOME, ~/.config, shell rc, systemd units,
cron, udev, /etc outside fakeroot — The
executed binary writes to the installing
user's home directory (~/.config/hypr/),
outside pkgdir/srcdir.
> This puts a hyprland.lua configuration with path
> ~/.config/hypr/hyprland.lua
↳ tokens: 4,438 in / 1,046 out · $0.0290

scanner usage: 1 call(s) · tokens: 4,438 in / 1,046 out · $0.0290
!! Installation blocked: 1 package(s) flagged MALICIOUS.

Best and cheers!
Andreas


On Fri, 2026-08-28 at 20:51 -0400, Carl T. Miller wrote:
> I have recently been reviewing PKGBUILD files and I'm still
> in the learning phase.  I tried to find the bad version of this
> package so I can study what it does and how it does it.
> 
> Apparently this version has been removed.  How do I find
> the original files?  Or, if it's better, let me ask how did you
> know there was a problem?
> 
> c
> 
> 
> On 8/28/26 4:02 PM, Saren wrote:
> > This package contains a real config of hyprland but it blatantly
> > opens
> > up a backdoor for the attacker:
> > 
> > Package URL: https://aur.archlinux.org/packages/hyprland-fixes
> > 
> > Package source repo:
> > https://github.com/iusearch-hyprlandbtw/hyprland-fixes
> > 
> > Source repo snapshot:
> > https://drop.wtako.net/file/22927ab5f074e4fafe959de72bb55db7768e1654.zip
> > (password: "backdoor" [8 characters]
> > 
> 

Reply via email to