Arch Linux AUR Malicious Package Campaign: Supply Chain Defense

---
title: Arch Linux AUR Helper Spawning Network Shell
date: 2026/04/22
id: 8c7d3e2a-1f9b-4a5c-9b6d-1e2f3a4b5c6d
status: experimental
description: Detects AUR helpers or makepkg spawning network tools like curl or wget, often indicative of malicious PKGBUILD scripts downloading payloads.
author: Security Arsenal
references:
  - https://wiki.archlinux.org/title/Arch_User_Repository
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - '/makepkg'
      - '/yay'
      - '/paru'
      - '/trizen'
      - '/pacaur'
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/python'
      - '/perl'
      - '/bash'
      - '/sh'
  condition: selection
falsepositives:
  - Legitimate package downloads from official sources (verify destination IPs)
level: high
tags:
  - attack.execution
  - attack.t1059.004
  - attack.supply_chain
---
title: Suspicious Execution from AUR Cache Directories
date: 2026/04/22
id: 9d8e4f3b-2a0c-5b6d-0c7e-2f3a4b5c6d7e
status: experimental
description: Detects execution of scripts or binaries directly from AUR build cache directories, a common technique for malware staged during build.
author: Security Arsenal
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|startswith:
      - '/home/'
      - '/var/tmp/'
    Image|contains:
      - '/.cache/yay/'
      - '/.cache/paru/'
      - '/.cache/trizen/'
      - '/.srcinfo-git/'
  condition: selection
falsepositives:
  - Legitimate testing or debugging by package maintainers
level: medium
tags:
  - attack.defense_evasion
  - attack.t1564.001

// Hunt for AUR helpers spawning suspicious network processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("makepkg", "yay", "paru", "trizen", "pacaur")
| where FileName in~ ("curl", "wget", "python", "python3", "perl", "bash", "sh")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FolderPath
| order by Timestamp desc

-- Hunt for PKGBUILD files in common AUR cache directories containing suspicious network indicators
SELECT FullPath, Mtime, Size
FROM glob(globs="/home/*/.cache/yay/*/PKGBUILD")
WHERE read_file(filename=FullPath, length=10000) =~ '(curl|wget|http|https|base64)'
   OR read_file(filename=FullPath, length=10000) =~ '(eval|exec)'

-- Scan for recent process executions spawned by makepkg
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ 'makepkg'
LIMIT 50

#!/bin/bash
# Audit script to check for recently installed AUR packages and verify integrity.
# Requires root privileges for full log access.

echo "[*] Auditing Arch Linux System for AUR Compromise..."

# 1. List all foreign packages (typically AUR) installed in the last 7 days
echo "[+] Detecting AUR packages installed in the last 7 days..."
pacman -Qmq | while read pkg; do
    # Get install date from local database (approximate check)
    if pacman -Qi "$pkg" | grep -q "Install Date"; then
        # Parse logic depends on locale, simpler to check log if available
        if grep -q "installed $pkg" /var/log/pacman.log 2>/dev/null; then
            # Extract date logic (simplified for demo)
            last_log=$(grep "installed $pkg" /var/log/pacman.log | tail -1)
            echo "Recent AUR Install Found: $pkg"
            echo "Log Entry: $last_log"
        fi
    fi
done

# 2. Check for active network connections from build processes (optional snapshot)
echo "[+] Checking for active connections from build tools..."
ss -tulpen | grep -E '(makepkg|yay|paru)' || echo "No suspicious active connections found."

echo "[*] Audit complete. Manually review the PKGBUILD of any suspicious packages."