cirven systems / modules / pkg

cirven pkg

An AUR build script or an npm postinstall runs with your rights before you ever use the package. Malicious AUR packages shipping remote-access trojans have been found in the wild. pkg reads what will run before it runs. Static analysis only: nothing from the package is ever executed.

usage

$ cirven pkg check aur/some-browser-bin
cirven pkg · aur/some-browser-bin 1.0-1 · maintainer someone · 0 votes

[high] source comes from github.com/someone, upstream is github.com/mozilla
[high] downloads during build or install, bypassing checksums
       at   PKGBUILD:11
[med ] package first submitted 3 days ago

verdict: do not install
$ cirven pkg check npm/crossenv
[high] name is one typo away from "cross-env"
$ cirven pkg check ./PKGBUILD
$ eval "$(cirven pkg wrap paru)"   # every paru -S is checked first

signals

• sources: bare IPs, paste and file-drop hosts, plain http, forks instead of upstream, unpinned VCS
• checksums: SKIP on downloaded files, md5 or sha1 only. per architecture, signatures excepted
• scripts: downloads, pipes into interpreters, base64 payloads, eval, sudo, setuid, reverse shells, writes to the live system, services enabled from install scripts
• AUR: package age, orphaned packages, fresh changes to little-used packages, lines changed since your last check
• npm: install-time scripts and what they run, package age, names one typo from popular packages

Exit code: 0 no red flags, 1 review, 2 do not install, 3 not in the AUR. The wrapper blocks on 2, asks on 1, and lets repo packages, searches and upgrades through.

planned: pip, binary blob detection.

threat model

Stops: the common, lazy supply-chain attacks, which are most of them. Does not stop: a patient attacker hiding logic in compiled upstream code. Pair with cage to build untrusted packages without network or home access.