Hi,I'm not sure if this is the right place to post this, but here are two very useful Python scripts (originally in French, translated by Google).
Securing yay v13: Lua hooks against AUR threats: <https://notes-depad-fr.translate.goog//linux/2026/06/securiser-yay-v13-hooks-lua-contre-les-menaces-aur/?_x_tr_sl=fr&_x_tr_tl=en&_x_tr_hl=en> AUR compromise: secure your Arch with an audit script: <https://notes-depad-fr.translate.goog/linux/2026/06/aur-compromis-securisez-votre-arch-avec-un-script-daudit/?_x_tr_sl=fr&_x_tr_tl=en&_x_tr_hl=en> Regards a. Le 11/08/2026 à 12:34, Ralf Mardorf a écrit :
Hi Cynthia, since I don't yet know how I'll be using the AUR in the future, for example, whether I'll use AUR helper, I've labeled your email in case the information might still be useful to me. Other than that, I don't want to comment any further on the actual topic of the AUR for now. Security plays a secondary role for my Linux PC, but I still don’t neglect it too much. I run updates using a script, nothing special, more or less just a standard sudo pacman -Syu followed by echo $(arch-audit -f "%n | " | sort) | sed s/.$// . The script is old and not the be-all and end-all, for example, the colors indicating risk levels are lost. But I’d like to take this opportunity to remind everyone that computers aren’t playgrounds with lifeguards. For those who aren't familiar with arch-audit yet, I find it useful for getting a rough overview of the current overall status of my computer. $ arch-audit | grep High\ risk djvulibre is affected by arbitrary code execution. High risk! grub is affected by multiple issues. High risk! jdk8-openjdk is affected by multiple issues. High risk! jre8-openjdk-headless is affected by multiple issues. High risk! libxml2 is affected by denial of service. High risk! linux-lts is affected by multiple issues, including information disclosure. High risk! pam is affected by arbitrary filesystem access. High risk! https://archlinux.org/packages/extra/x86_64/arch-audit/ https://security.archlinux.org/ Btw. no script is required, a hook and an indicator are also provided, see https://gitlab.archlinux.org/archlinux/arch-audit/-/work_items/3 . I should really get into the habit of doing some spring cleaning. I just discovered pkg-audit, which hasn't been maintained for over 9 years. $ pacman -Qi pkg-audit Name : pkg-audit Version : 0.3-1 Description : audit installed packages against known vulnerabilities Architecture : any URL : https://github.com/jelly/pkg-audit [snip] Install Date : Sat 18 Mar 2017 12:16:14 CET Install Reason : Explicitly installed [snip] $ sudo pacman -Rss pkg-audit [snip] Regards, Ralf
OpenPGP_0x9B5093D759491815.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
