Greetings. On Mon, 2026-08-24 at 09:27 +0200, Jelle van der Waa wrote: > > You don't need to clone the whole AUR either way, just the GitHub > mirror [1] > > [1] https://github.com/archlinux/aur
I have scanned all 19,934 AUR packages that declare install=. Static rules only, no model involved. 7 packages remain flagged. 6 look like real concerns to me: code-writer, codium-nautilus-git, home-assistant-hassio curl/wget an upstream install.sh and pipe it to a shell at build or install time chaotic-aur-setup pacman -U --noconfirm of a keyring straight from a CDN surfshark-yac the scriptlet writes /usr/lib/systemd/system/surfsharkd2.service onto the live system sysinfo-bin the scriptlet runs pacman -S --needed git, i.e. pacman inside a pacman transaction, for something that should be a depends() None of these is malicious as far as I can tell — they are packages handing control to a third party, or doing at install time what belongs in the PKGBUILD. The seventh is a false positive of mine (a zero-width character in a package's marketing text). Nothing resembling the xsnow worm turned up anywhere else. Tooling is at https://github.com/manticore-projects/aurscan (now v0.8.3) if anyone wants to reproduce or disagree with the rules. Best and cheers, Andreas
