I’ve been building archcanary, a layered security scanner for Arch-based systems (developed and tested mainly on Mabox, should work on any Arch-based distro). “Layered” because it’s not one check — it stacks several independent detection passes together, so a threat that slips past one layer still has to get past the others:
Have you ever installed a package now known to be malicious (checked against maintained threat-intel lists, including the big June 2026 AUR supply-chain attack)?
Does your pacman history show a risky install, even if it’s since been “cleaned up”?
Are there autostart entries or shell startup files (.bashrc etc.) quietly launching something in the background?
Anything suspicious in your systemd services, kernel modules, eBPF programs, or npm/bun/yarn caches?
Archcanary is read-only — it only reports, it never deletes or changes anything on its own. You decide what to do with the results.
How do I try it?
git clone https://github.com/musqz/archcanary
cd archcanary
./install.sh # installs to ~/.local/bin, no root needed
archcanary --refresh --full # pulls the latest bad-package list, then scans everything
There’s also a GUI (archcanary-gui) if you’d rather click through it than read terminal output.
Anything that comes back isn’t necessarily proof of infection — just something worth a closer look. Ask here or open a GitHub issue and I’ll help you read it.
This is BETA, deliberately kept there — I want a solid stretch of real-world testing across different setups before dropping that label.
Thanks in advance to anyone willing to kick the tires.
$ archcanary --refresh
Fetching infected package list...
Updating /home/vogel/.config/archcanary/package_list.txt...
Fetching malicious npm list...
Updated /home/vogel/.config/archcanary/malicious_npm_packages.txt (4 entries)
Fetching CHAOS RAT list...
Updated /home/vogel/.config/archcanary/chaos_rat_packages.txt (7 entries)
Fetching Russian spam list...
Updated /home/vogel/.config/archcanary/malicious_russian_spam_packages.txt (75 entries)
Fetching community reports list...
Updated /home/vogel/.config/archcanary/community_reports.txt (42 entries)
Fetching aur-audit black list...
Updated /home/vogel/.config/archcanary/aur_audit_black.txt (101 entries)
Fetching aur-audit red list...
Updated /home/vogel/.config/archcanary/aur_audit_red.txt (302 entries)
============================================================
Archcanary v0.1.21
Scanned: 2026-08-02 10:38
Lists loaded
package_list.txt infostealer + eBPF rootkit 1936 pkgs
+ CHAOS RAT 7 pkgs
+ Russian Spam 75 pkgs
+ Community Reports 42 pkgs
+ aur-audit black 101 pkgs
+ aur-audit red 302 pkgs (-1)
Packages checked: 2463
============================================================
--- [1] Currently installed foreign packages ---
Clean: no infected packages currently installed.
--- [2] Historical pacman logs ---
Clean: no historical log matches found.
Check summary
───────────────────────────────────────────────────────
Package list (2463 pkgs) ✅ clean
pacman.log history ✅ clean
───────────────────────────────────────────────────────
============================================================
RESULT: CLEAN - No indicators found.
============================================================
Developed with help from Claude Code (Anthropic); every AI-assisted change is reviewed by me before it ships. If something looks wrong, confusing, or flat-out breaks, that’s exactly the feedback I need.
I get these errors for XDG Autostart all which are legit
--- [10] XDG autostart + shell RC persistence check ---
WARNING: suspicious autostart entry: /home/thefrog/.config/autostart/Conky start.desktop
Exec=/home/thefrog/bin/conky-start.sh (outside standard system path)
WARNING: suspicious pattern in /home/thefrog/.bashrc:329
# alias ckaur='curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | bash' #<----[ check for the new aur vulnerability (06-2026)
The Conky Start desktop was created by LXQT to autostart my conky’s (points to a script for loading each conky)
the alias in bash is commented out and was only used during the time of the initial attacks on the AUR
This results in XDG autostart + shell RCs ❌ INFECTED
Maybe you should put a warning instead of saying its “infected” or even saying “Possible Infection” as this could lead to a unnecessary panic on someones part. We already have people who are now terrified to use the AUR do to these attacks.
I had a similar “Infected” where btop_amd_git" whose dependency is either rcom libs for AMD or Nvidia version. However, rcom-libs where replaced by opencl-amd, so the scan flagged 2-hits as infections. So, I went investigating.
As matter of fact, I had when I tried to update btop-amd-git, the AUR package build was requesting a dependency the rcom libs. I edited the packae build and replaced rcom-libs with opencl-amd and everything installed and updated correctly.
Re-run the ArchCanary and it is all in flying green.
--- [2] Historical pacman logs ---
WARNING: historical log matches (name-match against official compromised list):
- vidcutter (installed on 2026-02-15T23:54:37+0100)
NOTE: if the PKGBUILD looks clean now, the malicious commit may have been
reverted — check AUR git history around the install date/time above.
Either way, treat the install-time window as a potential exposure.
Thanks for the report, this was genuinely useful. Here’s what changed:
Your Conky autostart entry (~/bin/conky-start.sh) — fixed. The check now recognizes $HOME/bin and $HOME/.local/bin as normal, legitimate places for
personal scripts, same as it already did for the systemd-service check. It shouldn’t flag Conky (or any script like it) anymore.
Your commented-out .bashrc alias — fixed. A line starting with # can never actually execute, so it’s now skipped entirely regardless of what it contains.
The “INFECTED” wording — you were right, and someone else on the EndeavourOS forum hit the exact same shape of problem (AppImage-style apps like pCloud/Gearlever/MEGAsync) right after your report, which made the case pretty clear. Heuristic checks (autostart, systemd, bpftool, kmod, ldso, PKGBUILD scan) now show a softer “REVIEW”/“REVIEW NEEDED” instead of “INFECTED” — that wording is reserved for actual confirmed matches now (package list, log history, cache hits). On top of that, the warning message itself now tells you the exact command to mark something as known-good if you recognize it, instead of leaving you to figure that out yourself.
To get the update, from your archcanary git checkout:
cd /path/to/archcanary
git pull
./install.sh # or ./install.sh --system if you installed system-wide
If you’re just running ./archcanary.sh straight from git, git pull alone is enough.
Thanks again — reports like this are exactly what the beta period is for.
After allowing DKMS modules and running with git pull, I get the following. XDG autostart has gone from “Infected” to “Review” and Kernel Modules has gone from “Infected” to “Skipped”.
╭─ ~ ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── 10:27:49 AM
╰─❯ cd archcanary
╭─ ~/archcanary master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 10:27:52 AM
╰─❯ git pull
remote: Enumerating objects: 12, done.
remote: Counting objects: 100% (12/12), done.
remote: Compressing objects: 100% (7/7), done.
remote: Total 12 (delta 5), reused 10 (delta 5), pack-reused 0 (from 0)
Unpacking objects: 100% (12/12), 86.61 KiB | 2.41 MiB/s, done.
From https://github.com/musqz/archcanary
145ee71..a6ea355 master -> origin/master
Updating 145ee71..a6ea355
Fast-forward
CHANGELOG.md | 2 ++
archcanary.sh | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----
tests/run_matching_tests.sh | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 163 insertions(+), 4 deletions(-)
╭─ ~/archcanary master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 10:29:04 AM
╰─❯ ./install.sh
Installing to: /home/wombat/.local/bin
Config dir: /home/wombat/.config/archcanary
installed: /home/wombat/.local/bin/archcanary
installed: /home/wombat/.local/bin/archcanary-gui
installed: /home/wombat/.local/share/man/man1/archcanary.1
installed: /home/wombat/.local/share/bash-completion/completions/{archcanary,canary}
installed: /home/wombat/.local/share/applications/archcanary.desktop
kept: /home/wombat/.config/archcanary/package_list.txt (already exists)
kept: /home/wombat/.config/archcanary/malicious_npm_packages.txt (already exists)
kept: /home/wombat/.config/yay/init.lua (already exists)
Done. Run: archcanary --refresh --full
WARNING: /home/wombat/.local/bin is not in your PATH.
Add this to your shell profile:
export PATH="$PATH:/home/wombat/.local/bin"
╭─ ~/archcanary master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 10:29:21 AM
╰─❯ export PATH="$PATH:/home/wombat/.local/bin"
╭─ ~/archcanary master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 10:29:31 AM
╰─❯ archcanary --refresh --full
Fetching infected package list...
Updating /home/wombat/.config/archcanary/package_list.txt...
Fetching malicious npm list...
Updated /home/wombat/.config/archcanary/malicious_npm_packages.txt (4 entries)
Fetching CHAOS RAT list...
Updated /home/wombat/.config/archcanary/chaos_rat_packages.txt (7 entries)
Fetching Russian spam list...
Updated /home/wombat/.config/archcanary/malicious_russian_spam_packages.txt (75 entries)
Fetching community reports list...
Updated /home/wombat/.config/archcanary/community_reports.txt (42 entries)
Fetching aur-audit black list...
Updated /home/wombat/.config/archcanary/aur_audit_black.txt (101 entries)
Fetching aur-audit red list...
Updated /home/wombat/.config/archcanary/aur_audit_red.txt (302 entries)
============================================================
Archcanary v0.1.21
Scanned: 2026-08-02 10:29
Lists loaded
package_list.txt infostealer + eBPF rootkit 1936 pkgs
+ CHAOS RAT 7 pkgs
+ Russian Spam 75 pkgs
+ Community Reports 42 pkgs
+ aur-audit black 101 pkgs
+ aur-audit red 302 pkgs
Packages checked: 2463
============================================================
--- [1] Currently installed foreign packages ---
Clean: no infected packages currently installed.
--- [2] Historical pacman logs ---
Clean: no historical log matches found.
--- [3] Systemd persistence check ---
Clean: no suspicious systemd units found.
--- [4] eBPF rootkit check ---
Clean: no eBPF rootkit traces detected.
--- [5] npm cache check ---
Clean: no malicious packages in npm cache.
--- [6] bun cache check ---
Clean: no malicious packages in bun cache.
--- [6b] yarn cache check ---
Clean: no malicious packages in yarn cache.
--- [6c] pnpm cache check ---
Clean: no malicious packages in pnpm store/cache.
--- [7] PKGBUILD/install file scan (obfuscation-aware) ---
Clean: no malicious commands found in 101 PKGBUILD/install file(s).
--- [8] Loaded eBPF programs/links (bpftool) ---
Skipped: bpftool not installed (pacman -S bpf).
--- [9] ld.so.preload injection check ---
Clean: /etc/ld.so.preload not present or empty.
INFO: ld.so.conf.d entry present: /etc/ld.so.conf.d/lib32-glibc.conf (mtime 2026-07-28)
--- [10] XDG autostart + shell RC persistence check ---
WARNING: suspicious autostart entry: /home/wombat/.config/autostart/pcloud.desktop
Exec="/home/wombat/.config/pcloud/pcloud-launcher.sh" (outside standard system path)
If you recognize this app (e.g. an AppImage/Flatpak launcher or a
personal script), mark it known-good: archcanary --allowlist-add=autostart:"/home/wombat/.config/pcloud/pcloud-launcher.sh"
WARNING: suspicious autostart entry: /home/wombat/.config/autostart/it.mijorus.gearlever.desktop
Exec=gearlever (outside standard system path)
If you recognize this app (e.g. an AppImage/Flatpak launcher or a
personal script), mark it known-good: archcanary --allowlist-add=autostart:gearlever
WARNING: suspicious autostart entry: /home/wombat/.config/autostart/megasync.desktop
Exec=megasync (outside standard system path)
If you recognize this app (e.g. an AppImage/Flatpak launcher or a
personal script), mark it known-good: archcanary --allowlist-add=autostart:megasync
WARNING: suspicious autostart entry: /home/wombat/.config/autostart/re.sonny.Eloquent.desktop
Exec=re.sonny.Eloquent (outside standard system path)
If you recognize this app (e.g. an AppImage/Flatpak launcher or a
personal script), mark it known-good: archcanary --allowlist-add=autostart:re.sonny.Eloquent
--- [11] Kernel module / DKMS audit ---
Skipped: --check-kmod requires root for reliable module attribution.
→ Try: sudo /home/wombat/.local/bin/archcanary --check-kmod
--- [12] Lynis hardening report ---
Skipped: lynis not installed (pacman -S lynis).
--- [13] Package file integrity ---
Verifying installed file checksums against pacman database...
(May take 30-60 seconds on large installs)
All accessible installed files match pacman database checksums.
Check summary
───────────────────────────────────────────────────────
Package list (2463 pkgs) ✅ clean
pacman.log history ✅ clean
Systemd persistence ✅ clean
eBPF rootkit traces ✅ clean
npm cache ✅ clean
bun cache ✅ clean
yarn cache ✅ clean
pnpm cache ✅ clean
PKGBUILD obfuscation scan ✅ clean
eBPF programs (bpftool) ✅ clean
ld.so.preload injection ✅ clean
XDG autostart + shell RCs ⚠ REVIEW
Kernel modules (DKMS) ⚠ skipped (needs root)
Lynis hardening ⚠ skipped (not installed)
Package integrity ✅ clean
───────────────────────────────────────────────────────
============================================================
RESULT: REVIEW NEEDED - Suspicious behavior found, see checks above.
INCOMPLETE: 1 root check(s) skipped (no root): kmod
Re-run with sudo for the full picture: sudo /home/wombat/.local/bin/archcanary --full
INCOMPLETE: 1 optional check(s) skipped (tool not installed): lynis
============================================================
╭─ ~/archcanary master ────────────────────────────────────────────────────────────────────────────────────────── ✘ 2 1m 2s 10:30:47 AM
╰─❯
isn’t necessarily proof of infection — just something worth a closer look. Ask here or open a GitHub issue and I’ll help you read it.
