Archcanary — a layered security scanner for Arch-based Linux

made-lief · August 2, 2026, 8:44am

Hey everyone,

I’ve been building archcanary, a layered security scanner for Arch-based systems (developed and tested mainly on Mabox, should work on any Arch-based distro). “Layered” because it’s not one check — it stacks several independent detection passes together, so a threat that slips past one layer still has to get past the others:

Have you ever installed a package now known to be malicious (checked against maintained threat-intel lists, including the big June 2026 AUR supply-chain attack)?
Does your pacman history show a risky install, even if it’s since been “cleaned up”?
Are there autostart entries or shell startup files (.bashrc etc.) quietly launching something in the background?
Anything suspicious in your systemd services, kernel modules, eBPF programs, or npm/bun/yarn caches?

Archcanary is read-only — it only reports, it never deletes or changes anything on its own. You decide what to do with the results.

How do I try it?

git clone https://github.com/musqz/archcanary
cd archcanary
./install.sh          # installs to ~/.local/bin, no root needed
archcanary --refresh --full   # pulls the latest bad-package list, then scans everything

There’s also a GUI (archcanary-gui) if you’d rather click through it than read terminal output.

Anything that comes back isn’t necessarily proof of infection — just something worth a closer look. Ask here or open a GitHub issue and I’ll help you read it.

This is BETA, deliberately kept there — I want a solid stretch of real-world testing across different setups before dropping that label.

Repo: https://github.com/musqz/archcanary
Issues/bugs: https://github.com/musqz/archcanary/issues

Thanks in advance to anyone willing to kick the tires.

$ archcanary --refresh 

Fetching infected package list...
Updating /home/vogel/.config/archcanary/package_list.txt...
Fetching malicious npm list...
Updated /home/vogel/.config/archcanary/malicious_npm_packages.txt (4 entries)
Fetching CHAOS RAT list...
Updated /home/vogel/.config/archcanary/chaos_rat_packages.txt (7 entries)
Fetching Russian spam list...
Updated /home/vogel/.config/archcanary/malicious_russian_spam_packages.txt (75 entries)
Fetching community reports list...
Updated /home/vogel/.config/archcanary/community_reports.txt (42 entries)
Fetching aur-audit black list...
Updated /home/vogel/.config/archcanary/aur_audit_black.txt (101 entries)
Fetching aur-audit red list...
Updated /home/vogel/.config/archcanary/aur_audit_red.txt (302 entries)
============================================================
 Archcanary v0.1.21
 Scanned: 2026-08-02 10:38

 Lists loaded
   package_list.txt  infostealer + eBPF rootkit  1936 pkgs
   + CHAOS RAT         7 pkgs
   + Russian Spam     75 pkgs
   + Community Reports 42 pkgs
   + aur-audit black 101 pkgs
   + aur-audit red   302 pkgs (-1)

 Packages checked: 2463
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages currently installed.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.


 Check summary
 ───────────────────────────────────────────────────────
 Package list (2463 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: CLEAN - No indicators found.
============================================================

Developed with help from Claude Code (Anthropic); every AI-assisted change is reviewed by me before it ships. If something looks wrong, confusing, or flat-out breaks, that’s exactly the feedback I need.

made-lief · August 2, 2026, 9:53am

Hi @swh,

I take your debugging to this topic. To keep a cleaner track of issues and more

cd to /git
git pull
sudo ./archcanary.sh --allowlist-add=autostart:/usr/bin/eos-update-notifier
./archcanary.sh  --allowlist-list=autostart

Or use th gui

./archcanary-gui.sh # yad
./archcanary-gui.sh --no-gui # terminal

Rescan as user

./archcanary.sh --refresh --full

Thanks for the feedback, this helps fine-tuning the tool.

swh · August 2, 2026, 9:55am

Great Idea. Well done and thank you!

Nice

Check summary
 ───────────────────────────────────────────────────────
 Package list (2463 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ✅  clean
 Kernel modules (DKMS)                ✅  clean
 Lynis hardening                      ⚠   warnings
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: WARNINGS - Review output above.

Beiruty · August 2, 2026, 11:36am

I will give at try and report back of any issues or recommendations.

thefrog · August 2, 2026, 11:43am

I get these errors for XDG Autostart all which are legit

--- [10] XDG autostart + shell RC persistence check ---
  WARNING: suspicious autostart entry: /home/thefrog/.config/autostart/Conky start.desktop
    Exec=/home/thefrog/bin/conky-start.sh (outside standard system path)
  WARNING: suspicious pattern in /home/thefrog/.bashrc:329
    # alias ckaur='curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | bash'  #<----[ check for the new aur vulnerability (06-2026)

The Conky Start desktop was created by LXQT to autostart my conky’s (points to a script for loading each conky)
the alias in bash is commented out and was only used during the time of the initial attacks on the AUR

This results in
XDG autostart + shell RCs ❌ INFECTED

Maybe you should put a warning instead of saying its “infected” or even saying “Possible Infection” as this could lead to a unnecessary panic on someones part. We already have people who are now terrified to use the AUR do to these attacks.

Beiruty · August 2, 2026, 12:58pm

I had a similar “Infected” where btop_amd_git" whose dependency is either rcom libs for AMD or Nvidia version. However, rcom-libs where replaced by opencl-amd, so the scan flagged 2-hits as infections. So, I went investigating.
As matter of fact, I had when I tried to update btop-amd-git, the AUR package build was requesting a dependency the rcom libs. I edited the packae build and replaced rcom-libs with opencl-amd and everything installed and updated correctly.
Re-run the ArchCanary and it is all in flying green.

sammiev · August 2, 2026, 1:02pm

This surprised me a little, not sure how to move forward with everything ok but the log file.

Check summary
 ───────────────────────────────────────────────────────
 Package list (2463 pkgs)             ✅  clean
 pacman.log history                   ❌  INFECTED
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ✅  clean
 Kernel modules (DKMS)                ✅  clean
 Lynis hardening                      ⚠   skipped (not installed)
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: INFECTED - Indicators found! Follow incident response.
 INCOMPLETE: 1 optional check(s) skipped (tool not installed): lynis

UncleSpellbinder · August 2, 2026, 2:22pm

I followed this…

made-lief:

git clone https://github.com/musqz/archcanary
cd archcanary
./install.sh          # installs to ~/.local/bin, no root needed
archcanary --refresh --full   # pulls the latest bad-package list, then scans everything

I get this…

─❯ archcanary --refresh
fish: Unknown command: archcanary
─❯ archcanary --refresh --full
fish: Unknown command: archcanary
─❯

sammiev · August 2, 2026, 2:31pm

At the end of the install it states that you need to add the PATH:

export PATH="$PATH:/home/xxx/.local/bin"

UncleSpellbinder · August 2, 2026, 2:33pm

I got it. I had to run export PATH="$PATH:/home/wombat/.local/bin"…

─❯ archcanary --refresh --full
fish: Unknown command: archcanary
─❯ export PATH="$PATH:/home/wombat/.local/bin"
─❯ archcanary --refresh --full
Fetching infected package list...
Updating /home/wombat/.config/archcanary/package_list.txt...
Fetching malicious npm list...
Updated /home/wombat/.config/archcanary/malicious_npm_packages.txt (4 entries)
Fetching CHAOS RAT list...
Updated /home/wombat/.config/archcanary/chaos_rat_packages.txt (7 entries)
Fetching Russian spam list...
Updated /home/wombat/.config/archcanary/malicious_russian_spam_packages.txt (75 entries)
Fetching community reports list...
Updated /home/wombat/.config/archcanary/community_reports.txt (42 entries)
Fetching aur-audit black list...
Updated /home/wombat/.config/archcanary/aur_audit_black.txt (101 entries)
Fetching aur-audit red list...
Updated /home/wombat/.config/archcanary/aur_audit_red.txt (302 entries)
============================================================
 Archcanary v0.1.21
 Scanned: 2026-08-02 09:29

 Lists loaded
   package_list.txt  infostealer + eBPF rootkit  1936 pkgs
   + CHAOS RAT         7 pkgs
   + Russian Spam     75 pkgs
   + Community Reports 42 pkgs
   + aur-audit black 101 pkgs
   + aur-audit red   302 pkgs

 Packages checked: 2463
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages currently installed.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.

--- [3] Systemd persistence check ---
  Clean: no suspicious systemd units found.

--- [4] eBPF rootkit check ---
  Clean: no eBPF rootkit traces detected.

--- [5] npm cache check ---
  Clean: no malicious packages in npm cache.

--- [6] bun cache check ---
  Clean: no malicious packages in bun cache.

--- [6b] yarn cache check ---
  Clean: no malicious packages in yarn cache.

--- [6c] pnpm cache check ---
  Clean: no malicious packages in pnpm store/cache.

--- [7] PKGBUILD/install file scan (obfuscation-aware) ---
  Clean: no malicious commands found in 101 PKGBUILD/install file(s).

--- [8] Loaded eBPF programs/links (bpftool) ---
  Skipped: bpftool not installed (pacman -S bpf).

--- [9] ld.so.preload injection check ---
  Clean: /etc/ld.so.preload not present or empty.
  INFO: ld.so.conf.d entry present: /etc/ld.so.conf.d/lib32-glibc.conf (mtime 2026-07-28)

--- [10] XDG autostart + shell RC persistence check ---
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/pcloud.desktop
    Exec="/home/wombat/.config/pcloud/pcloud-launcher.sh" (outside standard system path)
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/it.mijorus.gearlever.desktop
    Exec=gearlever (outside standard system path)
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/megasync.desktop
    Exec=megasync (outside standard system path)
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/re.sonny.Eloquent.desktop
    Exec=re.sonny.Eloquent (outside standard system path)

--- [11] Kernel module / DKMS audit ---
  Skipped: --check-kmod requires root for reliable module attribution.
  → Try: sudo /home/wombat/.local/bin/archcanary --check-kmod

--- [12] Lynis hardening report ---
  Skipped: lynis not installed (pacman -S lynis).

--- [13] Package file integrity ---
  Verifying installed file checksums against pacman database...
  (May take 30-60 seconds on large installs)
  All accessible installed files match pacman database checksums.


 Check summary
 ───────────────────────────────────────────────────────
 Package list (2463 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ❌  INFECTED
 Kernel modules (DKMS)                ⚠   skipped (needs root)
 Lynis hardening                      ⚠   skipped (not installed)
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: INFECTED - Indicators found! Follow incident response.
 INCOMPLETE: 1 root check(s) skipped (no root): kmod
 Re-run with sudo for the full picture: sudo /home/wombat/.local/bin/archcanary --full
 INCOMPLETE: 1 optional check(s) skipped (tool not installed): lynis
============================================================
─❯

UncleSpellbinder · August 2, 2026, 2:34pm

Yep. Found is you erere responding. Thanks.

UncleSpellbinder · August 2, 2026, 2:36pm

What is this?

XDG autostart + shell RCs ❌ INFECTED

swh · August 2, 2026, 2:43pm

Same like mine. False Positive. Look here:

UncleSpellbinder · August 2, 2026, 2:49pm

Uh, oh. Re-ran because of this in the output…

INCOMPLETE: 1 root check(s) skipped (no root): kmod
 Re-run with sudo for the full picture: sudo /home/wombat/.local/bin/archcanary *--full*

─❯ sudo /home/wombat/.local/bin/archcanary --full
[sudo] password for wombat: 
============================================================
Check summary
 ───────────────────────────────────────────────────────
 Package list (2463 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ❌  INFECTED
 Kernel modules (DKMS)                ❌  INFECTED
 Lynis hardening                      ⚠   skipped (not installed)
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: INFECTED - Indicators found! Follow incident response.
 INCOMPLETE: 1 optional check(s) skipped (tool not installed): lynis
============================================================
─❯

Kernel modules (DKMS) Infected???

made-lief · August 2, 2026, 2:57pm

@UncleSpellbinder
I need to set tuxedo drivers as allowed.

You need to do the same for your situation.

Maybe this helps you to point you in the right direction.

UncleSpellbinder · August 2, 2026, 3:19pm

Authenticate in the polkit dialog to continue...
  After authenticating, please wait — the first scan fetches package lists from the network.


============================================================

Fetching infected package list...
Updating /home/wombat/.config/archcanary/package_list.txt...
Fetching malicious npm list...
Updated /home/wombat/.config/archcanary/malicious_npm_packages.txt (4 entries)
Fetching CHAOS RAT list...
Updated /home/wombat/.config/archcanary/chaos_rat_packages.txt (7 entries)
Fetching Russian spam list...
Updated /home/wombat/.config/archcanary/malicious_russian_spam_packages.txt (75 entries)
Fetching community reports list...
Updated /home/wombat/.config/archcanary/community_reports.txt (42 entries)
Fetching aur-audit black list...
Updated /home/wombat/.config/archcanary/aur_audit_black.txt (101 entries)
Fetching aur-audit red list...
Updated /home/wombat/.config/archcanary/aur_audit_red.txt (302 entries)
============================================================
 Archcanary v0.1.21
 Scanned: 2026-08-02 10:15

 Lists loaded
   package_list.txt  infostealer + eBPF rootkit  1936 pkgs
   + CHAOS RAT         7 pkgs
   + Russian Spam     75 pkgs
   + Community Reports 42 pkgs
   + aur-audit black 101 pkgs
   + aur-audit red   302 pkgs

 Packages checked: 2463
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages currently installed.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.

--- [3] Systemd persistence check ---
  Clean: no suspicious systemd units found.

--- [4] eBPF rootkit check ---
  Clean: no eBPF rootkit traces detected.

--- [5] npm cache check ---
  Clean: no malicious packages in npm cache.

--- [6] bun cache check ---
  Clean: no malicious packages in bun cache.

--- [6b] yarn cache check ---
  Clean: no malicious packages in yarn cache.

--- [6c] pnpm cache check ---
  Clean: no malicious packages in pnpm store/cache.

--- [7] PKGBUILD/install file scan (obfuscation-aware) ---
  Clean: no malicious commands found in 101 PKGBUILD/install file(s).

--- [8] Loaded eBPF programs/links (bpftool) ---
  Skipped: bpftool not installed (pacman -S bpf).

--- [9] ld.so.preload injection check ---
  Clean: /etc/ld.so.preload not present or empty.
  INFO: ld.so.conf.d entry present: /etc/ld.so.conf.d/lib32-glibc.conf (mtime 2026-07-28)

--- [10] XDG autostart + shell RC persistence check ---
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/pcloud.desktop
    Exec="/home/wombat/.config/pcloud/pcloud-launcher.sh" (outside standard system path)
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/it.mijorus.gearlever.desktop
    Exec=gearlever (outside standard system path)
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/megasync.desktop
    Exec=megasync (outside standard system path)
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/re.sonny.Eloquent.desktop
    Exec=re.sonny.Eloquent (outside standard system path)

--- [11] Kernel module / DKMS audit ---
  Clean: all loaded modules traceable to pacman packages or DKMS.
  WARNING: DKMS module from untracked source: nvidia/610.43.03, 6.18.41-1-lts, x86_64: installed
  WARNING: DKMS module from untracked source: nvidia/610.43.03, 7.1.5-arch1-2, x86_64: installed
  WARNING: DKMS module from untracked source: nvidia/610.43.03, 7.1.5-zen1-2-zen, x86_64: installed

--- [12] Lynis hardening report ---
  Skipped: lynis not installed (pacman -S lynis).

--- [13] Package file integrity ---
  Verifying installed file checksums against pacman database...
  (May take 30-60 seconds on large installs)
  All accessible installed files match pacman database checksums.

============================================================
 RESULT: INFECTED - Indicators found! Follow incident response.
 INCOMPLETE: 1 optional check(s) skipped (tool not installed): lynis
============================================================

─── done ───

made-lief · August 2, 2026, 3:20pm

We need section [2] from the log.

Example

--- [2] Historical pacman logs ---
    WARNING: historical log matches (name-match against official compromised list):
    - vidcutter (installed on 2026-02-15T23:54:37+0100)
    NOTE: if the PKGBUILD looks clean now, the malicious commit may have been
    reverted — check AUR git history around the install date/time above.
    Either way, treat the install-time window as a potential exposure.

made-lief · August 2, 2026, 3:23pm

Update on your report — both issues fixed.

Thanks for the report, this was genuinely useful. Here’s what changed:

Your Conky autostart entry (~/bin/conky-start.sh) — fixed. The check now recognizes $HOME/bin and $HOME/.local/bin as normal, legitimate places for
personal scripts, same as it already did for the systemd-service check. It shouldn’t flag Conky (or any script like it) anymore.
Your commented-out .bashrc alias — fixed. A line starting with # can never actually execute, so it’s now skipped entirely regardless of what it contains.
The “INFECTED” wording — you were right, and someone else on the EndeavourOS forum hit the exact same shape of problem (AppImage-style apps like pCloud/Gearlever/MEGAsync) right after your report, which made the case pretty clear. Heuristic checks (autostart, systemd, bpftool, kmod, ldso, PKGBUILD scan) now show a softer “REVIEW”/“REVIEW NEEDED” instead of “INFECTED” — that wording is reserved for actual confirmed matches now (package list, log history, cache hits). On top of that, the warning message itself now tells you the exact command to mark something as known-good if you recognize it, instead of leaving you to figure that out yourself.

To get the update, from your archcanary git checkout:

cd /path/to/archcanary
git pull
./install.sh          # or ./install.sh --system if you installed system-wide

If you’re just running ./archcanary.sh straight from git, git pull alone is enough.

Thanks again — reports like this are exactly what the beta period is for.

UncleSpellbinder · August 2, 2026, 3:36pm

After allowing DKMS modules and running with git pull, I get the following. XDG autostart has gone from “Infected” to “Review” and Kernel Modules has gone from “Infected” to “Skipped”.

╭─ ~ ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── 10:27:49 AM 
╰─❯ cd archcanary


╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 10:27:52 AM 
╰─❯ git pull

remote: Enumerating objects: 12, done.
remote: Counting objects: 100% (12/12), done.
remote: Compressing objects: 100% (7/7), done.
remote: Total 12 (delta 5), reused 10 (delta 5), pack-reused 0 (from 0)
Unpacking objects: 100% (12/12), 86.61 KiB | 2.41 MiB/s, done.
From https://github.com/musqz/archcanary
   145ee71..a6ea355  master     -> origin/master
Updating 145ee71..a6ea355
Fast-forward
 CHANGELOG.md                |  2 ++
 archcanary.sh               | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----
 tests/run_matching_tests.sh | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 163 insertions(+), 4 deletions(-)

╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 10:29:04 AM 
╰─❯ ./install.sh
Installing to: /home/wombat/.local/bin
Config dir:    /home/wombat/.config/archcanary

  installed: /home/wombat/.local/bin/archcanary
  installed: /home/wombat/.local/bin/archcanary-gui
  installed: /home/wombat/.local/share/man/man1/archcanary.1
  installed: /home/wombat/.local/share/bash-completion/completions/{archcanary,canary}
  installed: /home/wombat/.local/share/applications/archcanary.desktop
  kept:      /home/wombat/.config/archcanary/package_list.txt (already exists)
  kept:      /home/wombat/.config/archcanary/malicious_npm_packages.txt (already exists)
  kept:      /home/wombat/.config/yay/init.lua (already exists)

Done. Run: archcanary --refresh --full

WARNING: /home/wombat/.local/bin is not in your PATH.
Add this to your shell profile:
  export PATH="$PATH:/home/wombat/.local/bin"

╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 10:29:21 AM 
╰─❯ export PATH="$PATH:/home/wombat/.local/bin"

╭─ ~/archcanary  master ──────────────────────────────────────────────────────────────────────────────────────────────────────── 10:29:31 AM 
╰─❯ archcanary --refresh --full
Fetching infected package list...
Updating /home/wombat/.config/archcanary/package_list.txt...
Fetching malicious npm list...
Updated /home/wombat/.config/archcanary/malicious_npm_packages.txt (4 entries)
Fetching CHAOS RAT list...
Updated /home/wombat/.config/archcanary/chaos_rat_packages.txt (7 entries)
Fetching Russian spam list...
Updated /home/wombat/.config/archcanary/malicious_russian_spam_packages.txt (75 entries)
Fetching community reports list...
Updated /home/wombat/.config/archcanary/community_reports.txt (42 entries)
Fetching aur-audit black list...
Updated /home/wombat/.config/archcanary/aur_audit_black.txt (101 entries)
Fetching aur-audit red list...
Updated /home/wombat/.config/archcanary/aur_audit_red.txt (302 entries)
============================================================
 Archcanary v0.1.21
 Scanned: 2026-08-02 10:29

 Lists loaded
   package_list.txt  infostealer + eBPF rootkit  1936 pkgs
   + CHAOS RAT         7 pkgs
   + Russian Spam     75 pkgs
   + Community Reports 42 pkgs
   + aur-audit black 101 pkgs
   + aur-audit red   302 pkgs

 Packages checked: 2463
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages currently installed.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.

--- [3] Systemd persistence check ---
  Clean: no suspicious systemd units found.

--- [4] eBPF rootkit check ---
  Clean: no eBPF rootkit traces detected.

--- [5] npm cache check ---
  Clean: no malicious packages in npm cache.

--- [6] bun cache check ---
  Clean: no malicious packages in bun cache.

--- [6b] yarn cache check ---
  Clean: no malicious packages in yarn cache.

--- [6c] pnpm cache check ---
  Clean: no malicious packages in pnpm store/cache.

--- [7] PKGBUILD/install file scan (obfuscation-aware) ---
  Clean: no malicious commands found in 101 PKGBUILD/install file(s).

--- [8] Loaded eBPF programs/links (bpftool) ---
  Skipped: bpftool not installed (pacman -S bpf).

--- [9] ld.so.preload injection check ---
  Clean: /etc/ld.so.preload not present or empty.
  INFO: ld.so.conf.d entry present: /etc/ld.so.conf.d/lib32-glibc.conf (mtime 2026-07-28)

--- [10] XDG autostart + shell RC persistence check ---
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/pcloud.desktop
    Exec="/home/wombat/.config/pcloud/pcloud-launcher.sh" (outside standard system path)
    If you recognize this app (e.g. an AppImage/Flatpak launcher or a
    personal script), mark it known-good: archcanary --allowlist-add=autostart:"/home/wombat/.config/pcloud/pcloud-launcher.sh"
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/it.mijorus.gearlever.desktop
    Exec=gearlever (outside standard system path)
    If you recognize this app (e.g. an AppImage/Flatpak launcher or a
    personal script), mark it known-good: archcanary --allowlist-add=autostart:gearlever
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/megasync.desktop
    Exec=megasync (outside standard system path)
    If you recognize this app (e.g. an AppImage/Flatpak launcher or a
    personal script), mark it known-good: archcanary --allowlist-add=autostart:megasync
  WARNING: suspicious autostart entry: /home/wombat/.config/autostart/re.sonny.Eloquent.desktop
    Exec=re.sonny.Eloquent (outside standard system path)
    If you recognize this app (e.g. an AppImage/Flatpak launcher or a
    personal script), mark it known-good: archcanary --allowlist-add=autostart:re.sonny.Eloquent

--- [11] Kernel module / DKMS audit ---
  Skipped: --check-kmod requires root for reliable module attribution.
  → Try: sudo /home/wombat/.local/bin/archcanary --check-kmod

--- [12] Lynis hardening report ---
  Skipped: lynis not installed (pacman -S lynis).

--- [13] Package file integrity ---
  Verifying installed file checksums against pacman database...
  (May take 30-60 seconds on large installs)
  All accessible installed files match pacman database checksums.


 Check summary
 ───────────────────────────────────────────────────────
 Package list (2463 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ⚠   REVIEW
 Kernel modules (DKMS)                ⚠   skipped (needs root)
 Lynis hardening                      ⚠   skipped (not installed)
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: REVIEW NEEDED - Suspicious behavior found, see checks above.
 INCOMPLETE: 1 root check(s) skipped (no root): kmod
 Re-run with sudo for the full picture: sudo /home/wombat/.local/bin/archcanary --full
 INCOMPLETE: 1 optional check(s) skipped (tool not installed): lynis
============================================================

╭─ ~/archcanary  master ────────────────────────────────────────────────────────────────────────────────────────── ✘ 2  1m 2s  10:30:47 AM 
╰─❯

made-lief · August 2, 2026, 3:46pm

Thanks working on it