Checks pacman logs for infected aur packages

wpnews.pro

| android-signapk-gui | |
| android-support-repository | |

| annobin | |

| ansible-language-server | |
| antfs-cli-git | |

| anythingllm-appimage | |

| anythingllm-cli-bin | |
| apk-installer-gui | |

| apple-music-desktop | |
| arch-update-vai | |

| epson-inkjet-printer-escpr2-clos-bin | |
| exodus-wallet-bin | |

| fcitx5-pinyin-sougou-dict-git | |
| ffmpeg-bitrate-stats | |
| ffmpeg-quality-metrics | |

| findpkg-git | |

| firefox-extension-adnauseam-bin-amo | |
| firmium-desktop-git | |

| git-annex-standalone | |
| gnome-contacts-git | |
| gnome-randr-rust | |

| green-tunnel-bin | |
| greetd-wlgreet-git | |

| hearthstone-linux-gui-appimage | |
| hearthstone-linux-gui-bin | |

| ios-webkit-debug-proxy | |
| ipfs-desktop-bin | |

| linux-cachyos-deckify-native | |
| linux-cachyos-deckify-native-headers | |
| linux-cachyos-native | |
| linux-cachyos-native-headers | |
| linux-cachyos-native-nvidia-open | |
| linux-cachyos-rc-native | |
| linux-cachyos-rc-native-headers | |
| linux-cachyos-rc-native-nvidia-open | |

| mimic-node-git | |
| mingw-w64-geos | |
| mingw-w64-libsndfile | |
| minimax-bin-hardened | |

| neovim-autopairs-git | |
| neovim-nvim-treesitter | |

| nerf-pi | |

| neuro-karaoke-wrapper-git | |
| new-api-privacy-filter | |
| new-api-privacy-filter-git | |
| nextcloud-app-audioplayer | |
| nextcloud-app-facerecognition | |
| nextcloud-app-gpoddersync | |
| nextcloud-app-integration-google | |
| nextcloud-app-repod | |
| nextcloud-app-twofactor-gateway | |

| noctyra-dotfiles-git | |
| noctyra-meta-git | |
| "notepad---bin" | |

| penguin-subtitle-player | |
| perl-proc-parallelloop | |
| perl-set-object | |
| perl-term-extendedcolor | |
| phonon-qt5-vlc | |

| python-dj-database-url | |
| python-django-modelcluster | |
| python-django-rest-knox | |
| python-fastmcp-slim | |
| python-finnhub-python | |
| python-firebase-admin | |

| python-luckydonald-utils | |
| python-milvus-lite-bin | |

| python-netaudio-git | |
| python-netaudio-lib | |

| python-nodejs-wheel | |
| python-openai-harmony | |

| python-poetry-plugin-dotenv | |
| python-privy-git | |

| "python-pushbullet.py" | |

| python-pychromecast-git | |
| python-pylsp-rope | |

| python-scikit-hep-testdata | |
| python-sklearn-pandas | |

| rog-helper-git | |
| ros2-humble-nav2-msgs | |

| ruby-kramdown-rfc2629 | |
| ruby-selenium-webdriver | |

| typing-game-cli | |
| ukui-notification-daemon | |
| vapoursynth-preview-git | |

| zathura-gruvbox-git | |
| zerx-lab-dida-bin | |
| zerx-lab-zed-nightly-bin | |
| zing-8-bin | |
| zing-17-bin | |
| zing-21-bin | |

| START_DATE=${START_DATE:-2026-06-09} | |
| END_DATE=${END_DATE:-2026-06-12} | |
| PACMAN_LOG_GLOB=${PACMAN_LOG_GLOB:-/var/log/pacman.log*} | |
| CURRENT_FOUND=() | |
| HISTORICAL_FOUND=() | |
| LOG_WARNINGS=() | |
| date_in_window() { | |

| local date_value=$1 | |

| [[ "$date_value" < "$START_DATE" ]] && return 1 | |
| [[ "$date_value" > "$END_DATE" ]] && return 1 | |

| return 0 | | | } | | | install_date_in_window() { | | | local raw_date=$1 normalized_date | | | # pacman -Qi uses the current locale unless forced. The caller uses LC_ALL=C, | | | # so GNU date can reliably parse strings like "Thu 11 Jun 2026 10:00:00". | | | normalized_date=$(LC_ALL=C date -d "$raw_date" +%F 2>/dev/null) || return 1 | | | date_in_window "$normalized_date" | | | } | | | read_pacman_log_file() { | | | local file=$1 | | | case "$file" in | | | *.gz) | |

| if command -v gzip >/dev/null 2>&1; then | |
| gzip -cd -- "$file" | |

| else | | | LOG_WARNINGS+=("Skipped $file: gzip is not installed") | | | fi | | | ;; | | | *.xz) | |

| if command -v xz >/dev/null 2>&1; then | |
| xz -cd -- "$file" | |

| else | | | LOG_WARNINGS+=("Skipped $file: xz is not installed") | | | fi | | | ;; | | | *.zst) | |

| if command -v zstdcat >/dev/null 2>&1; then | |
| zstdcat -- "$file" | |

| else | | | LOG_WARNINGS+=("Skipped $file: zstdcat is not installed") | | | fi | | | ;; | | | *.bz2) | |

| if command -v bzip2 >/dev/null 2>&1; then | |
| bzip2 -cd -- "$file" | |

| else | | | LOG_WARNINGS+=("Skipped $file: bzip2 is not installed") | | | fi | | | ;; | | | *) | |

| cat -- "$file" | |
| ;; | |

| esac | | | } | | | scan_pacman_logs() { | | | local file | | | local log_files=() | | | # Expand the configured glob safely. The default includes pacman.log and common | | | # rotated variants such as pacman.log.1, pacman.log.2.gz, or pacman.log.3.zst. | | | for file in $PACMAN_LOG_GLOB; do | | | [[ -e "$file" ]] && log_files+=("$file") | | | done | |

| if [[ ${#log_files[@]} -eq 0 ]]; then | |
| LOG_WARNINGS+=("No pacman log files matched: $PACMAN_LOG_GLOB") | |

| return 0 | | | fi | | | { | |

| printf 'PKG\t%s\n' "${INFECTED_PKGS[@]}" | |
| for file in "${log_files[@]}"; do | |
| [[ -r "$file" ]] || { LOG_WARNINGS+=("Skipped $file: not readable"); continue; } | |

| } | awk -v start="$START_DATE" -v end="$END_DATE" -F '\t' ' | |
| $1 == "PKG" { | |
| infected[$2] = 1 | |

| next | | | } | | | $1 == "LOG" { | | | line = $2 | |

| date = substr(line, 2, 10) | |
| if (date < start || date > end) next | |

| msg = line | |

| sub(/^\[[^]]+\] \[ALPM\] /, "", msg) | |
| split(msg, fields, " ") | |
| action = fields[1] | |
| pkg = fields[2] | |
| if ((action == "installed" || action == "upgraded" || action == "reinstalled") && infected[pkg]) { | |

| key = pkg SUBSEP date SUBSEP action SUBSEP line | | | if (!seen[key]++) { | | | printf "%s\t%s\t%s\t%s\n", pkg, date, action, line | | | } | | | } | | | } | | | ' | sort -u | | | } | |

| print_pkg_list() { | |
| local -n arr=$1 | |

| local pkg | | | for pkg in "${arr[@]}"; do | | | echo " - $pkg" | | | done | | | } | | | echo | | | echo "Checking for infected AUR packages (${#INFECTED_PKGS[@]} total)..." | | | echo "Campaign window: $START_DATE through $END_DATE" | | | echo | | | echo "Checking currently installed foreign packages..." | |

| while IFS= read -r pkg; do | |
| install_date=$(LC_ALL=C pacman -Qi -- "$pkg" 2>/dev/null | awk -F ': ' '/^Install Date/ { print $2; exit }') | |
| if [[ -n "$install_date" ]] && install_date_in_window "$install_date"; then | |
| CURRENT_FOUND+=("$pkg (Install Date: $install_date)") | |

| fi | |

| done < <(pacman -Qmq "${INFECTED_PKGS[@]}" 2>/dev/null) | |
| if [[ ${#CURRENT_FOUND[@]} -eq 0 ]]; then | |

| echo " Clean: no currently installed known infected package has an install date in the campaign window." | | | else | | | echo " WARNING: ${#CURRENT_FOUND[@]} currently installed possibly infected package(s):" | | | print_pkg_list CURRENT_FOUND | | | fi | | | echo | | | echo "Checking historical pacman logs..." | |

| while IFS=$'\t' read -r pkg date action line; do | |
| HISTORICAL_FOUND+=("$pkg ($action on $date) :: $line") | |
| done < <(scan_pacman_logs) | |
| if [[ ${#HISTORICAL_FOUND[@]} -eq 0 ]]; then | |

| echo " Clean: no known infected package install/upgrade/reinstall events found in pacman logs during the campaign window." | | | else | | | echo " WARNING: ${#HISTORICAL_FOUND[@]} historical pacman log event(s) matched:" | | | print_pkg_list HISTORICAL_FOUND | | | fi | | | if [[ ${#LOG_WARNINGS[@]} -gt 0 ]]; then | | | echo | | | echo "Log scan notes:" | | | print_pkg_list LOG_WARNINGS | | | fi | | | echo | | | if [[ ${#CURRENT_FOUND[@]} -eq 0 && ${#HISTORICAL_FOUND[@]} -eq 0 ]]; then | | | echo "Clean: no matches found by current-package or historical-log checks." | | | else | | | echo "WARNING: matches were found. Review the package build files/cache and consider incident-response steps." | | | fi | | | echo |

source & further reading

gist.github.com — original article Content Atomizer - Claude skill for repurposing content across platforms Enable screenshot/image input for custom Vision models in ZCode Profile-Guided Optimization for AI Agents — a practical playbook for compiling recurring agent workflows into deterministic software

Checks pacman logs for infected aur packages

Run your AI side-project on zahid.host