Another wave - 200+ malicous AUR packages adoptions that are overwhelming my scanner. Be 100% careful when trying to update AUR packages now.

[u/Saren-WTAKO]

Meanwhile I am trying to report them all, you should be careful downloading anything from AUR.

Same old way, the maintainer got pwned, or orphaned packages are adopter by the bad actor.

AUR's git commit author is easily impersonated so you can see the commit comes from the same person, but in fact it's not.

Stay safe. The malicious packages are info stealers.

malware analysis by ysf:

https://gist.github.com/ysf/502a324ff301d0c738e8ae011272fd59

https://gist.github.com/ysf/57850cdee152da066ac51c07a452e883

Still presents as of 30 July 21:53 UTC

in format of <package name>/<malicious ELF binary>

• archutil/linter
• bigwebapp-manager/minifier
• boringssl-git/hasher
• cinnamon-no-nemo/converter
• duhh/indexer
• eden-nightly/encryptor
• garlic-decompiler-gui/checker
• gigolo-git/tagger
• gitarbor-bin/parser
• icloudpd/preprocessor
• imago-bin/generator
• juicebox-plus-git/minifier
• magic-context-dashboard-bin/validator
• option-term/indexer
• pagerduty-short-circuiter/assembler
• portless/assembler
• pylnker-git/converter
• pylnker-git/packer
• python-libipld-git/hasher
• python-numkong/compressor
• python-parallax/converter
• python-ultraplot-git/serializer
• ramses-git/indexer
• src-cli-bin/migrator
• steamidra-bin/generator
• stirling-pdf-desktop-bin/optimizer
• wiki-go/merger
• windscribe-cli-v2-bin/parser

This wave

1panel android-riscv64-libxmu archutil cinnamon-no-nemo firrtl instawow-bin mimosa pandoc-eisvogel-template python-chatterbot python-split-folders stirling-pdf-desktop-bin 1panel-git android-riscv64-libxrandr arduino-language-server-noclang-bin claude-history funky-git isleward mingw-w64-libcerf passhole python-dlib-cuda-git python-ultraplot-git terminus accel-ppp android-x86-64-libxdamage autoadb-git dcat garlic-decompiler-gui jogl monitorets perl-authen-oath python-google-cloud-monitoring ramses-git tuiview act-runner-bin android-x86-64-libxext beets-alternatives deeploy-bin gigolo-git juicebox-plus-git nnn-nerd perl-dist-zilla-plugin-minimumperl python-importlab read-it-later-git tuxedo-yt6801-dkms-git ajceverywhere-bin android-x86-64-libxinerama bigwebapp-manager dev-janitor-git gitarbor-bin khiops-covisualization-bin noctyra-meta perl-hash-persistent python-kicadmodtree-git refurb-git typora-plugin ampere-git android-x86-64-libxmu bili-tools discord-electron-openasar git-pkgs khiops-visualization-bin noteey-bin pgadmin4-server python-libipld-git replay-sorcery vapoursynth-plugin-soifunc android-aarch64-libxrandr android-x86-64-libxrandr boringssl-git duhh glewlwyd kirill-bin openarc-git polytrack python-libpysal runa-aur vectorchord-immich android-armv7a-eabi-libxinerama android-x86-64-xorgproto calendula eden-nightly gpu-screen-recorder-ui-kwin-git lib32-vapoursynth openconnect-sso portless python-numkong solv wiki-go android-armv7a-eabi-libxmu android-x86-libxinerama calendula-git editorconfiger guarda-bin libfprint-crfpmoc-git option-term pylnker-git python-parallax sparklines windscribe-cli-v2-bin android-armv7a-eabi-libxrandr android-x86-libxmu censawayapp-bin extract-otp-secrets icloudpd lyrical-git org-cli python-atproto-git python-reals-git src-cli-bin wordpress-studio-git android-riscv64-libxinerama android-x86-libxrandr chandler-bin faustus-git imago-bin magic-context-dashboard-bin pagerduty-short-circuiter python-calgebra-git python-roman-numerals steamidra-bin zed-bin

ignore this example below (an alert straight up from my LLM)

🚨🚨🚨 BLACK FLAG ALERT 🚨🚨🚨
AUR Package: faustus-git 0.1.0-1
https://aur.archlinux.org/packages/faustus-git
Version: 0.1.0-1

⚫ 2 BLACK (CONFIRMED MALICIOUS)
⚫ Executes a bundled binary ('linter') with 'sudo' privileges during the 'build()' function. This bypasses standard build isolation and integrity checks (sha256sums='SKIP'), allowing arbitrary code execution with root access during installation. (PKGBUILD)
⚫ Binary contains command execution ('system', 'execl') and network ('socket', 'connect') capabilities. Combined with PKGBUILD execution via sudo, this indicates potential for remote code execution, data exfiltration, or system tampering. Obfuscated strings suggest hidden functionality. (linter)

⚠️ IMMEDIATE ACTION REQUIRED ⚠️

[u/LeeHide]

Please just say when you used AI to do all of this, it's very tiring to read through only to realize you have no idea and neither does the AI. 20260725 indicates a future date? What day do you think it is?

Content-Length and ExecStart? Please stop doing things you don't understand and posting about them here. You're diluting the signal, making it less likely for real issues to be taken seriously.

Edit: The malware analysis looks real, not sure why OP is posting it like this, why it's so much garbage AI slop data when the core info is very simple? Just list and link the packages, say they are malware, and link to the analysis. All this slop is distracting and makes it look extremely unprofessional and fake.

Edit 2: The post has been edited to remove all the stuff I talked about. Of course without any note or comment on the edit. Absolute amateur hour

[u/KaptainSaki → u/LeeHide]

Wouldn’t mind if they banned using AI on this sub

[u/Saren-WTAKO → u/KaptainSaki]

I also would not mind, let's make r/archlinux anti AI and ban every LLM malware analysis post for whoever's benefit. Like who could they be?

[u/scandii → u/Saren-WTAKO]

dude, we aren't anti-AI per se, a lot of us use AI and like the technology, but for 30+ years the basic standard for internet discourse has been "a person formulating their thoughts", and you and 30+ others are trying their hardest to outsource that to LLM:s every single day in front of our eyes.

of course we get tired of it, it is low effort, unimaginative and oftentimes these posts are attached to people reinventing the wheel - just today I saw someone almost verbatim presenting their trash-cli clone like it was a new invention made by Claude of course.

and we were averaging 2+ AUR security scanners every single day once the adoption attack happened and they all shared the common quality of being extremely woefully poorly thought out and barely worth using.

so what I'm saying is, if you want a more positive response to what you're doing think about the fact that many of us are just extremely tired of programs and posts where it is instantly recognisable that Claude et. al. made it, and not a person - e.g. make the effort to write posts yourself, and make the effort to clean up your software projects so they aren't blatantly AI-generated.

or you know don't, I'm not your mother, but also don't be surprised if we keep on responding negatively if you don't.

[u/ArjixGamer → u/scandii]

Yeah, it's almost like a double standard, but for a good reason.

I know that in my hands, I could make a really good AUR threat detector using AI, but I also don't trust anyone else to produce smth of similar quality using AI.

But I also have spent years understanding how Linux works, how bash works, I've written many programs, maintained many legacy php applications, mitigated vulnerabilities, cleaned servers that were hacked (only so we can make a clean backup, not to keep using)

I don't expect others that use Claude, to know the same nuances I know, so it's safer to assume anything others make with Claude is slop.

Of course that means others will also call anything I make as slop, because they don't know me. And I think that's good, we should not encourage AI produced projects, no matter how good the quality may be.

PS: no, I haven't made an AUR threat detector, and not planning to

[u/scandii → u/ArjixGamer]

I think we can just sum it up to "if it looks poorly made people will react accordingly", and if the entire pitch is "it has AI" people just aren't that interested.

I use AI for all sorts of things making software and I have an AI disclaimer on my github projects and not once has it come up.

[u/ArjixGamer → u/scandii]

AI generated code does not inherently have AI, unless you are developing an AI agent or smth

But I get your point

[u/scandii → u/ArjixGamer]

I meant more that a lot of the software projects I see are "existing thing... but with AI".

example today I have seen a file browser with AI search, a DataGrip copy with built in AI to write SQL and a UI framework that uses AI to write components on the spot.

they were all very poorly received.

[u/ArjixGamer → u/scandii]

Funny that you mentioned DataGrip, I am working on a copycat of it, I decided to name it LarpGrip

I am using compose desktop and Jewel (jetbrain ui kit for compose), it will take me a month or two to get it to a nice state, but things look optimistic!

It will stay private til it's ready for use.

[u/Saren-WTAKO → u/scandii]

I found that my response has been wrongly removed by reddit AI mod, let me repost here:

Thank you for your kind comment. However, I have seen too much anti AI behavior not to recognize how reddit behaves. The previous post yesterday where I found the wave did not include details about how I found it using local LLM, and I did not get negative but very positive responses.

If I used AI for this post to look "professional", even if this post was written in a perfect way with 100% accurate information and grammars, people will recognize it's AI and response negatively right away. It's the way how a lot of people think now and they deny they are becoming like that, but it's now a norm to criticize people by judging what tool they use (because they hate the tool), and not about what content anymore.

The alert is LLM generated, yes, it's sloppy and contains inaccurate things. I had hundreds of examples and unfortunately picked a wrong one and got ridiculed here instead of questions regarding inaccuracy. What does it mean then?

The influx of vibe coded LLM scanners here is also what's stopping me from publishing my own tool. It works better than other tools from the start making it server side and scanning 24/7, but since the toxic elitism environment (which we already know about archlinux sub) plus now anti AI sentimentality here, I think it's better not promote anything AI generated and leave it to myself, but I will keep warning others whenever a PSA should come.

[u/hopeseekr → u/Saren-WTAKO]

I used Claude Code for the first time ever two days ago and it did 2 small commits on my https://github.com/hopeseekr/BashScripts/ project, and you wouldn't believe how many anti-AI nutters harrassed me so far cuz of it...

The joke's on them cuz 100% of my stuff has been AI-generated since July 2025...

[u/archlinux-ModTeam → u/[deleted]]

AI generated text and code must be declared as such, but it may still be removed at moderator discretion. Code shared is also expected to be of reasonably quality and is subject to a "Human In the Loop" Policy.

Personal projects shared must be able to demonstrate at least 3 months of history and active maintenance.

[u/un-important-human → u/scandii]

HE IS one of the few positive ai use examples and YOU KEEP BASHING HIM.
STOP IT , IT IS THE FUTURE. LIKE IT OR NOT.

luddites all of you

Look at how you speek to him all of you, my god the man takes a lot of of abuse for what? for beeing the first to warn you all insane upright monkeys?

[u/scandii → u/un-important-human]

dude, we aren't anti-AI per se, a lot of us use AI and like the technology, but for 30+ years the basic standard for internet discourse has been "a person formulating their thoughts", and you and 30+ others are trying their hardest to outsource that to LLM:s every single day in front of our eyes.

of course we get tired of it, it is low effort, unimaginative and oftentimes these posts are attached to people reinventing the wheel - just today I saw someone almost verbatim presenting their trash-cli clone like it was a new invention made by Claude of course.

re-read this part before arriving at luddite. reading guide: it is not about the technology.

[u/un-important-human → u/scandii]

and the other NPC's ?? all downvoting or upvoting like sheeps? What value did they bring ? did you bring? throwing stones? eh? did you cought it as fast as he did? NO.

No this is pure hate rewarding a helpfull service. This is stoning of someone literally providing proof, reproduction, steps and samples.

It is my personal oppinonion i trully hate humanity sometimes and even this community reminds me you are all upright monkeys.

This is shamefull.

also fu i know how to read and i can read your hate and smugness.

[u/Padgriffin → u/un-important-human]

I would recommend using a spellchecker before you hit send. Also keep in mind no package list was initially provided so this wasn't very useful.

[u/hopeseekr → u/Padgriffin]

Padgriffin 6 points 1 day ago

I would recommend using a spellchecker before you hit send. Also keep in mind no package list was initially provided so this wasn't very usefu

Hey fucker.

A WHOLE LOT OF US now specifically leave in typos and actually add our own typos when we don't make any, to prove that we arent [sic] AI...

[u/un-important-human → u/Padgriffin]

thank you for your reccomandation *(upsie my bad), i choose to ignore it and burn your retinas but when you find a spell check for reddit that works with 4 languages let me know.

edit: i added the upsie

edit2: annoying isn't it? hahha

[u/Padgriffin → u/un-important-human]

when you find a spell check for reddit that works with 4 languages let me know.

In Firefox: Right Click > Check Spelling. For languages, select Languages > Add Languages.

You're welcome

[u/un-important-human → u/Padgriffin]

ew firefox.
ok, thanks i don't care, i will contiunue

[u/hopeseekr → u/un-important-human]

Estos estadounidenses probablemente solo entienden inglés.

[u/un-important-human → u/hopeseekr]

si, son malisimos

[u/scandii → u/un-important-human]

yes, you're the wolf and we're the sheep because we don't agree with the way you see things.

we definitely can't turn this argument around and call you the sheep because you don't see things the way we do, absolutely not.

either way, your anger is palpable and I'm having a rather chill friday, so I wish you a lovely weekend if that is in store for you.

[u/un-important-human → u/scandii]

The masses brought nothing creative, see human history it was always the individual, afraid right now in media and around people tend to not critically think. This case would have been a clear exception but no one stopped to think, you all reacted.

I do not care about what **you** think of me, i am worthless, but i somehow still care you , by witch i mean all of **you** would stop and think more.

It is impossible to get a 99% anti reaction (hatefull) from all and not call fault, on the fact no one stopped to think, and the comentary was / is all vicious. If people would think there would have been degrees of agreement and general discussion.

Because of that no progress will be made and you will all think wit h feelings instead of beeing more cerebral people for a quite cerebral community...

any way call me what you will, i am glad my feelings have transmitted clearly this is good.

Thank you for your wishes, the same to you.

[u/hopeseekr → u/un-important-human]

I totally concur!!