# Attack wave on AUR packages!

**URL:** <https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544>\
**Category:** Uncategorized\
**Created:** [June 12, 2026, 7:30am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544 "2026-06-12T07:30:02Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![SauronsMouth](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/sauronsmouth/32/4064_2.png) [@SauronsMouth](https://forum.maboxlinux.org/u/SauronsMouth)\
**Post date:** [June 25, 2026, 1:30am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/21 "2026-06-25T01:30:23Z")

</div>

> [@muzqs](#):
>
> Can you post the output again.

```auto
--- [8] Loaded eBPF programs/links (bpftool) ---
  Loaded eBPF programs: 22
  WARNING: lsm eBPF programs loaded by unknown process (expected systemd / AppArmor / SELinux).
  Unknown loaders: python3(556)

```

```auto

Python3 is used to load my VPN daemon. According to HTOP.

```

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [June 25, 2026, 7:36am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/22 "2026-06-25T07:36:52Z")

</div>

**Thanks for debugging, really helpful.**

The python3(556) warning is almost certainly ProtonVPN — its Linux daemon is Python-based and legitimately loads lsm eBPF hooks for the network killswitch. False positive on archcanary’s end.

Fixed in the latest commit — it now checks if the loader’s binary is a pacman-owned package and downgrades to INFO if so, instead of warning.

```auto
  git pull
  ./install.sh --system

```

---

<div class="post-metadata">

**Author:** ![SauronsMouth](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/sauronsmouth/32/4064_2.png) [@SauronsMouth](https://forum.maboxlinux.org/u/SauronsMouth)\
**Post date:** [June 25, 2026, 3:13pm UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/23 "2026-06-25T15:13:12Z")

</div>

> [@muzqs](#):
>
> The python3(556) warning is almost certainly ProtonVPN — its Linux daemon is Python-based and legitimately loads lsm eBPF hooks for the network killswitch. False positive on archcanary’s end.

Proton VPN is exactly what it is.

```auto
--- [8] Loaded eBPF programs/links (bpftool) ---
  Loaded eBPF programs: 26
  INFO: lsm eBPF programs loaded by non-systemd process (pacman-owned binary).
  Loaders: python3(556) (python)
  Perf attachments (kprobe/tracepoint): none.
  Net attachments (XDP/TC): none.

```

```auto
 Check summary
 ───────────────────────────────────────────────────────
 Package list (2016 pkgs) ✅ clean
 pacman.log history ✅ clean
 Systemd persistence ✅ clean
 eBPF rootkit traces ✅ clean
 npm cache ✅ clean
 bun cache ✅ clean
 yarn cache ✅ clean
 pnpm cache ✅ clean
 PKGBUILD obfuscation scan ✅ clean
 eBPF programs (bpftool) ✅ clean
 ld.so.preload injection ✅ clean
 XDG autostart + shell RCs ✅ clean
 Kernel modules (DKMS) ✅ clean
 Lynis hardening ✅ clean
 Package integrity ✅ clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: CLEAN - No indicators found.
============================================================

```

---

<div class="post-metadata">

**Author:** ![SauronsMouth](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/sauronsmouth/32/4064_2.png) [@SauronsMouth](https://forum.maboxlinux.org/u/SauronsMouth)\
**Post date:** [July 12, 2026, 8:44am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/24 "2026-07-12T08:44:49Z")

</div>

Coming back to this.

```auto

--- [10] XDG autostart + shell RC persistence check ---
WARNING: suspicious autostart entry: /home/donald/.config/autostart/zeitgeist-datahub.desktop
Exec=zeitgeist-datahub (outside standard system path)

```

The — [10] XDG AUTOSTART warning concerns me the most because I have deleted the .desktop file from /home/donald/.config/autostart folder several times and for some reason it returns after a while.

I don’t even have zeitgeist installed so I’m curious how this even got on my system. Deleted the .desktop file from both /etc/xdg/autostart and /home/donald/.config/autostart and rebooted. Let’s see what happens.

```auto
--- [11] Kernel module / DKMS audit ---
Clean: all loaded modules traceable to pacman packages or DKMS.
WARNING: DKMS module from untracked source: v4l2loopback/0.15.4, 6.12.95-1-MANJARO, x86_64: installed
WARNING: DKMS module from untracked source: v4l2loopback/0.15.4, 6.18.38-1-MANJARO, x86_64: installed

```

Nothing else has changed so I assume those warnings are false positives. (the DKMS warnings)

```auto

```

```auto
Check summary
───────────────────────────────────────────────────────
Package list (2016 pkgs) ✅ clean
pacman.log history ✅ clean
Systemd persistence ✅ clean
eBPF rootkit traces ✅ clean
npm cache ✅ clean
bun cache ✅ clean
yarn cache ✅ clean
pnpm cache ✅ clean
PKGBUILD obfuscation scan ✅ clean
eBPF programs (bpftool) ✅ clean
ld.so.preload injection ✅ clean
XDG autostart + shell RCs ❌ INFECTED
Kernel modules (DKMS) ❌ INFECTED
Lynis hardening ✅ clean
Package integrity ✅ clean
───────────────────────────────────────────────────────

```

```auto
RESULT: INFECTED - Indicators found! Follow incident response.

```

```auto
Failed to show notification: Error spawning command line “dbus-launch --autolaunch=42972456f8b742cda6541ecf979c5787 --binary-syntax --close-stderr”: Child process exited with code 1

```

FYI: A notification did appear on screen.

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [July 12, 2026, 10:29am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/25 "2026-07-12T10:29:16Z")

</div>

**Thanks @SauronsMouth for the report** — both warnings are now sorted out, and one of them turned out to be a real bug, so thank you for catching it.

**1. DKMS warning (v4l2loopback)** — this one’s expected, not a bug.  
DKMS-built kernel modules can’t be traced back to a pacman package, so archcanary has an allowlist for exactly this case.  
In the “DKMS Allowlist (system)” editor, just uncomment the line:

```auto
v4l2loopback # virtual camera (OBS, video conferencing)

```

 ![Mabox_20260712-11-51-00](https://forum.maboxlinux.org/uploads/default/original/2X/c/c75e21da3a3c065b9f35ff4391c2fdf6a7fdd068.png)

**2. Autostart warning (zeitgeist-datahub)** — archcanary’s check had a real gap (only resolved binaries on $PATH, missing legit package helpers installed elsewhere) and that’s fixed now.  
Also added an Autostart allowlist (GUI → Manage allowlists → “Autostart”) as a fallback for any similar case going forward instead of waiting on a code fix.

 ![Mabox_20260712-11-52-41](https://forum.maboxlinux.org/uploads/default/original/2X/9/98f6c6a55885721270ed3fc63effee4a43d20d4b.png)

**3. Where zeitgeist actually came from?**  
Since that’s a mistery, it could be pulled with another package (GNOME- adjacent packages are the usual culprit).  
_You removed the .desktop’s and rebooted. This should be fine now, i guess._

🐧

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [July 12, 2026, 10:35am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/26 "2026-07-12T10:35:14Z")

</div>

> [@SauronsMouth](#):
>
> ```auto
> Failed to show notification: Error spawning command line “dbus-launch --autolaunch=42972456f8b742cda6541ecf979c5787 --binary-syntax --close-stderr”: Child process exited with code 1
> 
> ```

This is expected behavior. Cosmetic failure.

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [July 12, 2026, 12:40pm UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/27 "2026-07-12T12:40:01Z")

</div>

_Update:_

## v0.1.11 (2026-07-12)

- New: **autostart allowlist** (`/etc/archcanary/autostart_allowlist.conf`).
- Fix: glob-metacharacter injection in the new non-PATH fallback.
- Fix: `notify-send` failing silently (`sudo archcanary --full`).
- Fix: curl/wget pipe-to-shell autostart/RC pattern now matches across newlines.
- Docs: fixed several stale/duplicated explanations found.

> **[GitHub - musqz/archcanary: Arch Linux security canary — layered AUR...](https://github.com/musqz/archcanary)**
>
> Arch Linux security canary — layered AUR supply-chain scanner with systemd, eBPF, and kmod auditing.

---

<div class="post-metadata">

**Author:** ![SauronsMouth](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/sauronsmouth/32/4064_2.png) [@SauronsMouth](https://forum.maboxlinux.org/u/SauronsMouth)\
**Post date:** [July 12, 2026, 4:17pm UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/28 "2026-07-12T16:17:26Z")

</div>

```auto
--- [10] XDG autostart + shell RC persistence check ---
  Clean: no suspicious autostart or shell RC entries found.

--- [11] Kernel module / DKMS audit ---
  Clean: all loaded modules traceable to pacman packages or DKMS.
  INFO: DKMS module allowlisted (not pacman-tracked): v4l2loopback/0.15.4, 6.12.95-1-MANJARO, x86_64: installed
  INFO: DKMS module allowlisted (not pacman-tracked): v4l2loopback/0.15.4, 6.18.38-1-MANJARO, x86_64: installed

 Check summary
 ───────────────────────────────────────────────────────
 Package list (2016 pkgs) ✅ clean
 pacman.log history ✅ clean
 Systemd persistence ✅ clean
 eBPF rootkit traces ✅ clean
 npm cache ✅ clean
 bun cache ✅ clean
 yarn cache ✅ clean
 pnpm cache ✅ clean
 PKGBUILD obfuscation scan ✅ clean
 eBPF programs (bpftool) ✅ clean
 ld.so.preload injection ✅ clean
 XDG autostart + shell RCs ✅ clean
 Kernel modules (DKMS) ✅ clean
 Lynis hardening ✅ clean
 Package integrity ✅ clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: CLEAN - No indicators found.
============================================================

```

WOOT! TY sir.

---

<div class="post-metadata">

**Author:** ![danielhb](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/danielhb/32/3941_2.png) [@danielhb](https://forum.maboxlinux.org/u/danielhb)\
**Post date:** [July 13, 2026, 1:30am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/29 "2026-07-13T01:30:20Z")

</div>

I’m trying it, it gives this to me:

```auto
 Check summary
 ───────────────────────────────────────────────────────
 Package list (2016 pkgs) ✅ clean
 pacman.log history ✅ clean
 Systemd persistence ✅ clean
 eBPF rootkit traces ✅ clean
 npm cache ✅ clean
 bun cache ✅ clean
 yarn cache ✅ clean
 pnpm cache ✅ clean
 PKGBUILD obfuscation scan ✅ clean
 eBPF programs (bpftool) ⚠ skipped (needs root)
 ld.so.preload injection ✅ clean
 XDG autostart + shell RCs ❌ INFECTED
 Kernel modules (DKMS) ⚠ skipped (needs root)
 Lynis hardening ⚠ skipped (needs root)
 Package integrity ✅ clean

 ───────────────────────────────────────────────────────
============================================================
 RESULT: INFECTED - Indicators found! Follow incident response.
 INCOMPLETE: 3 root check(s) skipped (no root): bpftool kmod lynis
 Re-run with sudo for the full picture: sudo /usr/local/bin/archcanary --full

============================================================

--- [10] XDG autostart + shell RC persistence check ---
  WARNING: suspicious autostart entry: /home/dhbmb/.config/autostart/zeitgeist-datahub.desktop
    Exec=zeitgeist-datahub (outside standard system path)
  WARNING: suspicious autostart entry: /home/dhbmb/.config/autostart/xfce4-power-manager.desktop
    Exec=xfce4-power-manager (outside standard system path)
  WARNING: suspicious autostart entry: /home/dhbmb/.config/autostart/skippy-xd.desktop
    Exec=skippy-xd (outside standard system path)
  WARNING: suspicious autostart entry: /home/dhbmb/.config/autostart/pulseaudio.desktop
    Exec=start-pulseaudio-x11 (outside standard system path)
  WARNING: suspicious autostart entry: /home/dhbmb/.config/autostart/light-locker.desktop
    Exec=light-locker (outside standard system path)

```

Could you tell me what it means?

Very interesting project. 👏

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [July 13, 2026, 5:14am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/30 "2026-07-13T05:14:22Z")

</div>

Hi @danielhb,

Can you show

```auto
archcanary --version

```

I suspect you have an older version, the latest version is v0.1.11.

---

<div class="post-metadata">

**Author:** ![danielhb](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/danielhb/32/3941_2.png) [@danielhb](https://forum.maboxlinux.org/u/danielhb)\
**Post date:** [July 13, 2026, 6:06am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/31 "2026-07-13T06:06:03Z")

</div>

```auto
archcanary --version
============================================================
 Archcanary v0.1.11
 Scanned: 2026-07-13 03:04

 Lists loaded
   package_list.txt infostealer + eBPF rootkit
   + CHAOS RAT 7 pkgs
   + Russian Spam 73 pkgs

 Packages checked: 2016
============================================================

--- [1] Currently installed foreign packages ---
  Clean: no infected packages currently installed.

--- [2] Historical pacman logs ---
  Clean: no historical log matches found.

 Check summary
 ───────────────────────────────────────────────────────
 Package list (2016 pkgs) ✅ clean
 pacman.log history ✅ clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: CLEAN - No indicators found.
============================================================

```

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [July 13, 2026, 9:20am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/32 "2026-07-13T09:20:34Z")

</div>

Hi @danielhb,

Please try again. The release push was not right, was still v0.1.10.  
Should be good now. **v0.1.11**

> **[GitHub - musqz/archcanary: Arch Linux security canary — layered AUR...](https://github.com/musqz/archcanary)**
>
> Arch Linux security canary — layered AUR supply-chain scanner with systemd, eBPF, and kmod auditing.

In your case…

```auto
git pull
./install

```

Thanks for debugging…

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [July 13, 2026, 10:48am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/33 "2026-07-13T10:48:37Z")

</div>

Update: Bumb version **v0.1.12**

I faced a bug: **Cache Log file owned by root**

- When running archcanary as root ` ~/.cache/archcanary/*.log` chown was set to root. This is fixed in new release _(v0.1.12)_.

> **[GitHub - musqz/archcanary: Arch Linux security canary — layered AUR...](https://github.com/musqz/archcanary)**
>
> Arch Linux security canary — layered AUR supply-chain scanner with systemd, eBPF, and kmod auditing.

If you have used archcanary as root the permission of some log files are likely root owned. For me this gave an issue using luckybackup wrong ownership.

Fix ownership to user with following command.

```auto
sudo chown $USER:$USER ~/.cache/archcanary/*.log

```

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [July 13, 2026, 11:30am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/34 "2026-07-13T11:30:05Z")

</div>

Update: latest commits. **Fix ownership log files for npm.**

If one has npm installed. The log files are also owned as root.

Fix ownership with

```auto
sudo chown $USER:$USER ~/.npm/_logs/*.log

```

Same release v0.1.12

---

<div class="post-metadata">

**Author:** ![danielhb](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/danielhb/32/3941_2.png) [@danielhb](https://forum.maboxlinux.org/u/danielhb)\
**Post date:** [July 14, 2026, 1:03am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/35 "2026-07-14T01:03:58Z")

</div>

I reinstalled and refreshed, it gives the same results.

I consulted Google’s AI about the warnings, and it says it might be because the .desktop files don’t contain the full path to the executable.

Indeed, my .desktop files don’t contain the full path:

```auto
Exec=xfce4-power-manager (disabled by me in mabox, hidden)
Hidden=true

Exec=zeitgeist-datahub (??? service? don´t run/locate by command line)
Hidden=true

Exec=skippy-xd --start-daemon (disabled by me in mabox, hidden)
Hidden=true

Exec=start-pulseaudio-x11 (disabled by me in mabox, hidden)
Hidden=true

Exec=light-locker (disabled by me in mabox, hidden)
Hidden=true

```

Maybe the hidden flag affects the result

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [July 14, 2026, 8:07am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/36 "2026-07-14T08:07:01Z")

</div>

Hi @danilehb,

**Your hidden=true theory was spot on** — that’s exactly what was going on, and it’s fixed now.

The check never looked at that flag, so a disabled entry got flagged just like a live one.

I didn’t create a new release for it. Latest v0.1.12.

> **For your interest:** _archcanary scans ~/.config/autostart/_.desktop for entries whose Exec= command can’t be verified as coming from a trusted system location.  
> It exists because that folder is a well-known persistence trick — drop a file there and it silently runs on every graphical login, no root, no systemd unit needed.

Thanks again for debugging. 🐧

---

<div class="post-metadata">

**Author:** ![danielhb](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/danielhb/32/3941_2.png) [@danielhb](https://forum.maboxlinux.org/u/danielhb)\
**Post date:** [July 15, 2026, 1:56am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/37 "2026-07-15T01:56:57Z")

</div>

> [@muzqs](#):
>
> **Your hidden=true theory was spot on** — that’s exactly what was going on, and it’s fixed now.

What should I do to get this correction applied? Sorry, I’m very ignorant, barely an amateur

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [July 15, 2026, 6:30am UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/38 "2026-07-15T06:30:14Z")

</div>

> [@danielhb](#):
>
> What should I do to get this correction applied? Sorry, I’m very ignorant, barely an amateur

To get the latest commits just as user.

```auto
git pull
./install

```

Or root install.

```auto
git pull
./install --system

```

Uninstall with

```auto
./install uninstall
or
./install uninstall --system

```

---

<div class="post-metadata">

**Author:** ![danielhb](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/danielhb/32/3941_2.png) [@danielhb](https://forum.maboxlinux.org/u/danielhb)\
**Post date:** [July 15, 2026, 12:32pm UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/39 "2026-07-15T12:32:57Z")

</div>

That’s what I’d done. I cloned your github again and ran the commands you told me (`install` doesn’t exist, there’s `install.sh`). And it gives the same results.

---

<div class="post-metadata">

**Author:** ![muzqs](https://forum.maboxlinux.org/user_avatar/forum.maboxlinux.org/muzqs/32/3702_2.png) [@muzqs](https://forum.maboxlinux.org/u/muzqs)\
**Post date:** [July 15, 2026, 4:06pm UTC](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544/40 "2026-07-15T16:06:39Z")

</div>

**Sorry for the `.sh` of install. The TAB key is my friend** ;).

There is no need to clone every time.  
The workflow is

```auto
cd /to/the/git/archcanary
git pull
./install.sh 

```

I just rechecked the installation on my machine.  
Both user and root are doing fine.

I can’t tell…

> [@danielhb](#):
>
> And it gives the same results.

Can you show the installation output.

[Previous page](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544.md?page=1)

[Next page](https://forum.maboxlinux.org/t/attack-wave-on-aur-packages/2544.md?page=3)