As a side note, that hook is pretty annoying if you have a lot of AUR packages. It asks for confirmation one at a time for every AUR package you update even if there are no issues flagged.
This is also probably a false positive.
As a side note, that PKGBUILD is a nightmare. That is what it takes to build ventoy? I definitely would not want that on my machine. It requires ancient versions(6+ years old) of software. The author is still building on a distro that went out of support 2 years ago.
To be clear, that is a ventoy issue, not an issue with the PKGBUILD.
This one is interesting, there is some HEX data embedded in the middle of the PKGBUILD which is what it is probably detecting. It is looks benign, but I am not sure the tool could easily figure that out.
Jep i know, the maintainer of Ventoy AUR agree that it is a nightmare but can’t do anything as it is indeed a developer issue.
I will remove ventoy though
@dalto how do i remove eveything that is installed to build ventoy?
if i do yay -Rns ventoy only ventoy itself would be removed
It would appear I’m living a sheltered life on my daily driver laptop (just 2 flagged “sketchy” apps, neither of which looks too sketchy to my naive eyeballs)…
Scanning 40 installed AUR packages...
Fetching package metadata...
Got metadata for 25/40 packages
Fetching maintainer data for 19 unique maintainers...
=== traur scan results ===
Scanned: 25 packages (15 errors)
TRUSTED: 21 OK: 2 SKETCHY: 2 SUSPICIOUS: 0 MALICIOUS: 0
=== 2 flagged packages (SKETCHY+) ===
traur: botan2 (trust: 52/100)
Trust: SKETCHY
Negative signals:
! P-CHECKSUM-MISMATCH: source count (1) != sha256sums count (2)
B-MAINTAINER-SINGLE: Maintainer has only 1 package
T-AUTHOR-CHANGE: Git history shows multiple different authors
! G-LD-LIBRARY-PATH: LD_LIBRARY_PATH manipulation (shared library injection)
traur: mbpfan-git (trust: 58/100)
Trust: SKETCHY
Negative signals:
! P-SYSTEMD-CREATE: Creating/enabling systemd service
P-WEAK-CHECKSUMS: Using weak checksums (md5/sha1) without stronger alternative
! P-CHECKSUM-MISMATCH: source count (3) != md5sums count (1)
T-AUTHOR-CHANGE: Git history shows multiple different authors
```**strong text**I have ventoy-bin and it didn’t pick it up as sketchy This is interesting
There must be something wrong here I guess mmmm
Scanning 11 installed AUR packages...
Fetching package metadata...
Got metadata for 11/11 packages
Fetching maintainer data for 9 unique maintainers...
=== traur scan results ===
Scanned: 11 packages (0 errors)
TRUSTED: 8 OK: 3 SKETCHY: 0 SUSPICIOUS: 0 MALICIOUS: 0
All packages look clean.
That might be right, the bin package is already been build on another computer, the build script is simply copying the necessary files to the right directorys.
So the build script does not contain any possible “malicious” stuff and passes.
If you remove orphans, the build deps should all go away. That being said, those things are mostly manual deps due to the old versions involved so they would be in your AUR helper cache.
That is because it is a binary. In that case, everything is already built into it.
@dalto Thanks!
Btw., that package is just 7 days old.
And it seems like the dev utilizes claude in some way, it’s uncertain to which degree actually. But there is an CLAUDE.md file in the repo, which is a strong indication that Claude Code is utilized within that code base.
That isn’t automatically a bad thing, but if you check the currently open issues, such as this one, which essentially cconcludes that last years AUR incident would go undetected by this application as the code won’t check the installation scripts which are being utilizted within a PKGBUILD.
Haven’t reviewed the code myself, but it seems like that the code just analyses PKGBUILDs and within the context of last years malware incident, the malicious code wasn’t included in them directly, but were referenced in external installations script. This would be a big oversight, as the dev claims to address the attack vectors of last years attacks.
Nevertheless, if you additionally check the repositories the dev has forked or which are published by him, this is the very first project written in rust. And among his other repos are things like crypto converter written in python and realtime crypto price comparison written in JavaScript. I don’t see any evidence of an profound security related background.
Sure, it could just be the case that the dev is just trying to establish himself with this project, and if he does utilize Claude Code to a certain degree, e.g. syntax checking and documentation purposes, it’s totally legitimate to automate some steps - as long as it’s not the whole code base which is written by claude code.
Last but not least, let me ask two rhetorical question to sum this up.
- Have you checked traurs PKGBUILD and the related installations scripts referenced within it before you installed the package ?
- Wouldn’t be a package like this to analyze other AUR PKGBUILDs in terms of it trustworthiness based on some metric a prime candidate to hide malicious code, hidden in plain sight, so to say ?
In the end, that’s obviously a project which is still in development and there might be false positives.
( But in terms of MEGAsync, I do agree with the rating that it is a somewhat malicous package 
)
Yes i did, and no i didn’t saw anything that raises questions
A fairly safe way to then clean up any orphans is:
yay -Yc
Hello! traur maintainer here
Thanks for the discussion. I’m happy people are using the package.
My goal is to maintain the project, make it better and make aur safer. If you have any ideas, don’t hesitate to contact me here or file issues on github. Also, I will try to fix all the false positives stated above and add new features
Yesterday I added detection of orphan takeover and upstream vs source url mismatch. More to come
freetube-bin and epsonscan2 as sketchy…I count on these
epsonscan2 is proprietary (“non-free”) so of course there is a “possible payload hiding”
but freetube? checksums and mismatches galore…maintainer simply errant with the paperwork?
Interesting tool. And thread.
Seems like an interesting take on policing the AUR. Hope it gets better through use of this tool (and others). @sohimaster are there plans to include a user-tweakable .config file so we can adjust scanning thresholds to match our own risk-averse-ity ?
╰─❮ traur scan
Scanning 24 installed AUR packages…
Fetching package metadata…
Got metadata for 22/24 packages
Fetching maintainer data for 19 unique maintainers…
=== traur scan results ===
Scanned: 22 packages (2 errors)
TRUSTED: 16 OK: 4 SKETCHY: 2 SUSPICIOUS: 0 MALICIOUS: 0
=== 2 flagged packages (SKETCHY+) ===
traur: brscan-skey (trust: 44/100)
Trust: SKETCHY
Negative signals:
! P-SYSTEMD-CREATE: Creating/enabling systemd service
! P-INSTALL-PERSISTENCE: Persistence mechanism in install script
B-SUBMITTER-CHANGED: Package maintainer (0x2501) differs from original submitter (leidola)
! B-ORPHAN-TAKEOVER: Adopted package with new git author (0x2501) — orphan takeover pattern
T-AUTHOR-CHANGE: Git history shows multiple different authors
traur: octopi (trust: 56/100)
Trust: SKETCHY
Negative signals:
! P-EVAL-VAR: Dynamic code execution via eval
! P-NO-CHECKSUMS: No checksum array found in PKGBUILD
B-SUBMITTER-CHANGED: Package maintainer (xiota) differs from original submitter (ImNtReal)
T-AUTHOR-CHANGE: Git history shows multiple different authors
May be a good idea to answer some of the concerns in @1093i3511’s post.
No need to address it here, as it’s just an afterthought of this posted issue over on github, which has been fixed already.
Nice tool you made and one that is needed after what we saw last year.
I hope the project get the support and feedback it deserves from Arch security team(and others) to improve even more to make AUR safe(er).
TRAUR only trusts itself at 74%. 
:: Proceed with installation? [Y/n]
(1/1) checking keys in keyring [--------------------------------] 100%
(1/1) checking package integrity [--------------------------------] 100%
(1/1) loading package files [--------------------------------] 100%
(1/1) checking for file conflicts [--------------------------------] 100%
:: Running pre-transaction hooks...
(1/1) Scanning packages for security issues...
╔╦╗╦═╗╔═╗╦ ╦╦═╗
║ ╠╦╝╠═╣║ ║╠╦╝
╩ ╩╚═╩ ╩╚═╝╩╚═
Trust scoring for AUR packages
traur: traur (trust: 74/100)
Trust: OK
Negative signals:
! P-PACMAN-HOOK: Pacman hook creation (unusual for AUR packages)
T-NEW-PACKAGE: Package is very new (2 days old)
traur: Continue with installation? [Y/n]
:: Processing package changes...
(1/1) upgrading traur [--------------------------------] 100%
:: Running post-transaction hooks...
(1/2) Arming ConditionNeedsUpdate...
(2/2) Checking which packages need to be rebuilt
Looking for updates…
Nothing to do.
Nothing unused to uninstall
Yes i noticed this too, maybe this needs to be excluded for traur itself? Now it indeed appears you don’t fully trust your own app and might confusing users?