I installed the regular traur package, not the bin package btw, it complied and installed in under a minute anyways: yay -S traur
I’ve got a nvidia mx150 so I have to use the nvidia-580-xx drivers from the AUR. So because of that, I figured why not install a few other gnome related apps from the AUR since I’ve got to use it anyways, which are apps that II like to use from time to time. I could install flatpak versions of cine, gradia, etc but part of the point for me being on endeavourOS is the ability to have native packages. Not sure I’ll keep this installed though, It was nice to check, but it’s not going to replace anything I already do.
scott@endeavourOS:~$ traur scan
Fetching package metadata for 13 installed packages...
Scanning 13 AUR packages...
Fetching maintainer data for 9 unique maintainers...
=== traur scan results ===
Scanned: 13 packages (0 errors)
TRUSTED: 9 OK: 4 SKETCHY: 0 SUSPICIOUS: 0 MALICIOUS: 0
=== 13 packages ===
traur: nvidia-580xx-dkms (trust: 62/100)
Trust: OK
Negative signals:
! P-SYSTEMD-CREATE: Creating/enabling systemd service
! P-KERNEL-MODULE-LOAD: Kernel module loading (potential rootkit)
traur: opencl-nvidia-580xx (trust: 62/100)
Trust: OK
Negative signals:
! P-SYSTEMD-CREATE: Creating/enabling systemd service
! P-KERNEL-MODULE-LOAD: Kernel module loading (potential rootkit)
traur: nvidia-580xx-utils (trust: 62/100)
Trust: OK
Negative signals:
! P-SYSTEMD-CREATE: Creating/enabling systemd service
! P-KERNEL-MODULE-LOAD: Kernel module loading (potential rootkit)
traur: traur (trust: 77/100)
Trust: OK
Negative signals:
! P-PACMAN-HOOK: Pacman hook creation (unusual for AUR packages)
traur: gradia (trust: 85/100)
Trust: TRUSTED
Negative signals:
P-CHECKSUM-MISMATCH: checksum count mismatch: source has 4 entries but sha256sums has 2
B-MAINTAINER-SINGLE: Maintainer has only 1 package
traur: minecraft-launcher (trust: 92/100)
Trust: TRUSTED
Negative signals:
B-SUBMITTER-CHANGED: Package maintainer (pschichtel) differs from original submitter (shoghicp)
T-AUTHOR-CHANGE: Git history shows multiple different authors
traur: pins (trust: 93/100)
Trust: TRUSTED
Negative signals:
M-VOTES-LOW: Package has very few votes (1)
T-AUTHOR-CHANGE: Git history shows multiple different authors
traur: parabolic (trust: 96/100)
Trust: TRUSTED
Negative signals:
B-SUBMITTER-CHANGED: Package maintainer (mhdi) differs from original submitter (bordam)
traur: gpu-screen-recorder-gtk (trust: 100/100)
Trust: TRUSTED
No negative signals found.
traur: cine (trust: 100/100)
Trust: TRUSTED
No negative signals found.
traur: libxnvctrl-580xx (trust: 100/100)
Trust: TRUSTED
No negative signals found.
traur: nvidia-580xx-settings (trust: 100/100)
Trust: TRUSTED
No negative signals found.
traur: refine (trust: 100/100)
Trust: TRUSTED
No negative signals found.
Thanks for pointing out that tool!
On my work notebook I also have one “sketchy” package with timeshift-autosnap, which I guess is to be expected as it hooks into pacman by design (if I understood that correctly):
[knut@Thinkbox ~]$ traur scan
Fetching package metadata for 10 installed packages...
Scanning 10 AUR packages...
Fetching maintainer data for 10 unique maintainers...
=== traur scan results ===
Scanned: 10 packages (0 errors)
TRUSTED: 8 OK: 1 SKETCHY: 1 SUSPICIOUS: 0 MALICIOUS: 0
=== 10 packages ===
traur: timeshift-autosnap (trust: 57/100)
Trust: SKETCHY
Negative signals:
! P-PACMAN-HOOK: Pacman hook creation (unusual for AUR packages)
B-SUBMITTER-CHANGED: Package maintainer (racehd) differs from original submitter (gobonja)
! B-ORPHAN-TAKEOVER: Adopted package with new git author (racehd) — orphan takeover pattern
T-AUTHOR-CHANGE: Git history shows multiple different authors
traur: traur-bin (trust: 77/100)
Trust: OK
Negative signals:
! P-PACMAN-HOOK: Pacman hook creation (unusual for AUR packages)
traur: splix (trust: 92/100)
Trust: TRUSTED
Negative signals:
B-SUBMITTER-CHANGED: Package maintainer (roceb) differs from original submitter (arojas)
T-AUTHOR-CHANGE: Git history shows multiple different authors
traur: jbig2enc (trust: 96/100)
Trust: TRUSTED
Negative signals:
T-AUTHOR-CHANGE: Git history shows multiple different authors
traur: ocrmypdf (trust: 96/100)
Trust: TRUSTED
Negative signals:
B-SUBMITTER-CHANGED: Package maintainer (fbrennan) differs from original submitter (dreuter)
traur: zotero-bin (trust: 96/100)
Trust: TRUSTED
Negative signals:
B-MAINTAINER-SINGLE: Maintainer has only 1 package
traur: netbird-ui-bin (trust: 97/100)
Trust: TRUSTED
Negative signals:
M-VOTES-LOW: Package has very few votes (3)
traur: python-fpdf2 (trust: 100/100)
Trust: TRUSTED
No negative signals found.
traur: netbird-bin (trust: 100/100)
Trust: TRUSTED
No negative signals found.
traur: darkly-bin (trust: 100/100)
Trust: TRUSTED
No negative signals found.
Will have to look at my main computer, as I have more aur packages installed there due to my videogame habbit…
It remains to be seen, but I’m curious to see if traur keeps up development or if the last commit from 4 months ago ends up being the last update since it looks like it was written by Claude LLM code.
I checked out the repo and noticed that too. Nothing inherently wrong with that nowadays though. Old account, which is good, but the author seems to have only one other project and not contributed to other public software much. Could be security researcher/dev maybe judging by the other project.
But the project is only a fews months old, and now we had an AUR attack and everybody starts using it? That was my tinfoil moment and I uninstalled it again. You guys test it, I’m coming back in a year.
That is a valid point. clamav has a strong focus on Windows malware. And for the few linux malware that exist clamav is only detecting 30-60 % if I remember correctly (don’t remember where I found that number). But in conjunction with freshclam, which adds unofficial signatures, it checks 39670 linux/unix specific signatures:
traur:logseq-desktop-bin (trust: 64/100)
Trust: OK
Negative signals:
B-MAINTAINER-SINGLE: Maintainer has only 1 package
B-SUBMITTER-CHANGED: Package maintainer (Manjusaka) differs from original submitter (xuanwo)
T-AUTHOR-CHANGE: Git history shows multiple different authors
! SA-HIGH-ENTROPY-HEREDOC: heredoc with high entropy (5.5 bits/byte, 606 bytes)
traur:traur (trust: 77/100)
Trust: OK
Negative signals:
! P-PACMAN-HOOK: Pacman hook creation (unusual for AUR packages)
traur:wootility (trust: 100/100)
Trust: TRUSTED
No negative signals found.
traur:google-chrome (trust: 100/100)
Trust: TRUSTED
No negative signals found.
traur:yubico-authenticator-bin (trust: 100/100)
Trust: TRUSTED
No negative signals found.
Thank you so much @mbod! Very kind of you to share your script!
You really got me inspired to look into clamv more closely.
I had previously, just occasionally run it on the content of some directories bur your script takes it to another level. If you don’t mind I could copy it and try adapting it to my system. Thanks again!
You couldn’t have said this any ‘better’. . . I’m in total agreement. . . If everything is still functional don’t worry too much about it. I have yet to see any major issues with my computer and it’s software working . . . ‘knock on wood’. . .
Then I saw the flag: " Maintainer created 21 packages in the last 48 hours"
Busy beaver I guess.
I’d consider revisiting Clam but everything running fine, as you say. I’ve grown really comfortable with a Linux-focused, audit AV called Lynis I use twice a year, btw.
Lynis will only audit your system’s security posture and may or may not detect if it has been compromised. Personally, I use ClamAV and RKHunter for threat detection, complemented by OpenSnitch and PicoSnitch for network control and monitoring. Together, they provide a good level of visibility into what’s happening on the system.
That was my tinfoil moment and I uninstalled it again. You guys test it, I’m coming back in a year. 
