Many of us have been using traur especially since the attacks. However after seeing a few discussions of its “Abandonment” I wonder if its worth keeping now. I’m assuming archcanary made by @made-lief is a better replacement for the scanning of already installed packages? I had originally thought the project was just completed but after hearing the author has abandoned it that sheds a new light on the reliability of the program. I guess I could do a poll but I am not really interested in doing that.
I posted in the “Issues” section of the TRAUR GitHub. We’ll see if it gets a reply.
Going to post this here
I believe this will answer the question If I should keep it or not for Myself and I believe at this point I will just remove it and replace it with archcanary
Seems the time has come…
╭─ ~ ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── 10:05:05 AM
╰─❯ yay -Rns traur
[sudo] password for wombat:
checking dependencies...
Package (1) Old Version Net Change
traur 0.4.1-1 -11.72 MiB
Total Removed Size: 11.72 MiB
:: Do you want to remove these packages? [Y/n]
:: Processing package changes...
(1/1) removing traur [--------------------------------------------------] 100%
:: Running post-transaction hooks...
(1/1) Arming ConditionNeedsUpdate...
╭─ ~ ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── 5s 10:05:23 AM
╰─❯
I analysed the traur project and could find 4 more packages Archcanary did’t have.
$ archcanary --refresh
============================================================
Archcanary v0.1.24
Scanned: 2026-08-04 17:43
Lists loaded
package_list.txt infostealer + eBPF rootkit 1936 pkgs
+ CHAOS RAT 7 pkgs
+ Russian Spam 75 pkgs
+ Community Reports 92 pkgs (+4)
+ aur-audit black 101 pkgs
+ aur-audit red 297 pkgs
Packages checked: 2508
============================================================
- google-chrome-stable
- chrome
- google-chrome-bin
- ttf-mac-fonts-all
I did not find traur package, but traur is installed. How do I safely uninstall it with the use of yay/pacman?
see a few responses above
if you installed the -bin version then make the appropriate changes
Ah, it was the traur-bin. It has been removed from my eos
I like the tool, I kept it installed.
Abandoned = no malware-y updates to worry about, right? App is frozen in time until someone makes another one that serves it verbose purpose.
Beside, we can’t be the only ones who loved the app, can we? Someone will step up.
BUT-If the new maintainer created a Github acct the day before he/she takes the app over then it’s -Rns time for me
It’s being abandoned isn’t the final straw that triggered me to remove it. It was a few other factors. 1 Since it will now appear to be harder to inject malware people will come up with new ways thus making the checks of this possibly unusable. 2. With the security issues going on with the AUR I think when a project is Abandoned it’s best to maybe find an alternative. There is no gurantee someone wont come take this over do fine for a while then push their malicious code onto unsuspecting systems. 3 as pointed out it really does it’s checks post install so your already infected when it detects it. 4. I rather support someone who supports the community. archcanary is made by a member of the community and I think it will be more accurate and more mantained then traur
2 and 3 are my biggest fears about keeping it.
As for 4, I use that tool everyday as well. It’s only getting better.
Got rid of traur yesterday. . . . removed it completely. . . I do what I can to make sure I don’t have infected files or apps. . . so far things are still working properly, despite all the fears everyone has for these incursions into AUR by scrupulous characters.
Rich 
No answer in this post I made several days ago. So, I’d guess the project is abandonware.
Bewaur is a fork of traur and seems to be in active development.
Just based on the metrics, traur doesn’t has seen wide scale adoption. Not even 200 github stars, less than 10 forks. And the fact that the issue posted by UncleSpellbinder is only the 26ths issue ever opened on the repository, 15 issues are still open. Only 5 have been closed.
Bewaur on the other hand - no stars, no forks. 10 commits ahead of traur. But it seems it hasn’t been used by anyone except the own maintainer who forked trauer 1 month ago. He didn’t packaged it for the AUR yet. I can’t tell if it’s an useful improvement of the original implementation, haven’t tried it yet.
In terms on the critique that traur only inspects the AUR packages after they have been build locally , well in an ideal scenario all packages would be build in a isolated clean root environment. If that would be the state / default, which it is not, it would be safe to compile packages locally. Even if they’re malicious.
That being said, “Why aren’t the AUR packages not build in a clean root environment already ?”, the answer to that question is more or less : “One Arch Dev would have to implement that on a feature level, first.” It’s not that easy as flipping an switch.
At least that is my current understanding from what I’ve read in terms of efforts to make AUR packages a bit more safe to use. But I could be mistaken, if so. Let me know
$ git clone ``git@github.com``:brickfrog/bewaur.git
Cloning into 'bewaur'...
The authenticity of host '``github.com`` (140.82.114.4)' can't be established.
ED25519 key fingerprint is: SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])?
started to install BeWaur…but what does this mean?
EDIT: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints github did update their SHA keys. I don’t think that message is related to Bewaur.
$ git clone git@github.com:brickfrog/bewaur.git
Cloning into 'bewaur'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
so I hit “yes” and another brick wall. Is this just a sudo thing?
DISREGARD ALL MY BEWAUR adventure:
Maintainer released updated version 8/7, today of -bin only https://aur.archlinux.org/packages/traur
Just now:
$ yay -Ss traur
aur/traur-bin 0.4.1-1 (+23 6.12) [163d11h]
Trust scoring for AUR packages (prebuilt)
will keep @made-lief 's tool and this tool. we are blessed with CVE checker now..
There hasn’t been anyupdates to the traur packages
The last updated to the AUR packages traur as well as traur-bin is [163d11h] old.
Just cloned the repo. And there are some misleading instructions
$ git clone git@github.com:brickfrog/bewaur.git
That’s cloning via ssh, which would only work if you’ve got an public ssh key in your github account.
You don’t have any public SSH keys in your GitHub account. You can add a new public key, or try cloning this repository via HTTPS.
Cloning via https work just fine.
$ git clone https://github.com/brickfrog/bewaur.git
Cloning into 'bewaur'...
remote: Enumerating objects: 1054, done.
remote: Counting objects: 100% (394/394), done.
remote: Compressing objects: 100% (178/178), done.
remote: Total 1054 (delta 258), reused 316 (delta 213), pack-reused 660 (from 1)
Receiving objects: 100% (1054/1054), 594.12 KiB | 2.42 MiB/s, done.
Resolving deltas: 100% (605/605), done.
The readme suggest to build a local Arch package from a committed checkout, or in case you don’t want to install the hooks to replace traur already, just do
cd bewaur
cargo build --release
Then the binary is available and could be testdriven, without the hooks
./target/release/bewaur scan [aur-package-to-inspect]
$ ./target/release/bewaur scan traur
bewaur: traur (trust: 71/100)
Trust: OK
Negative signals:
! P-PACMAN-HOOK: Pacman hook creation (unusual for AUR packages)
M-OUT-OF-DATE: Package is flagged as out of date
! M-COMMENTS-SECURITY: AUR comment mentions security concern (keyword: suspicious)
But that is as far as I’m willing to go with it at the moment. I’m not going to check if it works with yay, or if the hooks are solely provided for paru. Still prefer yay over paru, maybe due to the positive uplift in front of each updated routine 
Just gonna ask it,Wyh? IMO better wasting a few moments than let a machine tell you confinfendlt it is right whule being wrong - TLDR- Do the legwork and save some time the machiens learnt fro, it in the end anyeasu
The reason for tools like these is to have an EXTRA set of eyes however you are correct you should always read the PKGBUILDS yourself and rely on the information you keep up with. But an extra set of eyes (which is what my use was) is always good to have.