aur-scanner 3.0.0-1
seededverified· maintained by KiefStudio· GPL-3.0-or-later
Security scanner for Arch Linux AUR packages - detect malicious PKGBUILDs before installation
shelly install aur aur-scanner --aur-url https://atoll.seafoam-labs.org
This can be permanently set in the shelly
config.json file.
git clone https://atoll.seafoam-labs.org/packages/aur-scanner.git
Served Git SHAs are synthesized by Atoll when it commits stored revisions - they do not match
upstream AUR.
/v1/packages/aur-scanner/versions SHAs are authoritative.
Metadata
Relations
Depends
Make dependencies
Conflicts
Provides
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| c7ee6c8f6c5dhead | verified | 2026-11-10 16:51 | 2 |
| eca0eee0fc23 | verified | 2026-11-09 12:10 | 2 |
| fab61976d6ca | verified | 2026-11-09 11:32 | 2 |
| 897feb5de26e | verified | 2026-11-05 16:15 | 1 |
| f75d92d81c5d | verified | 2026-11-05 16:12 | 2 |
| 49903a07a1ed | verified | 2026-11-05 16:12 | 1 |
| 6a2f96529b3d | verified | 2026-11-05 16:07 | 1 |
Head findings
medium
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
medium
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
install -Dm644 "$_rule" "$pkgdir/usr/share/aur-scanner/rules.d/$(basename "$_rule")"
Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.