AUR AI Security is an AI-assisted review pipeline for the Arch User Repository. It indexes package versions, examines AUR Git repositories for malware and supply-chain risk, and presents the evidence in a searchable web interface.
Read the article · Try the live demo
Every assessment preserves the exact Git commit, complete PKGBUILD, and commit diff so that its verdict can be reviewed rather than treated as a black box.
An AUR PKGBUILD or install script is code that runs while software is built and installed. During the June 2026 active AUR malicious-packages incident, Arch removed malicious commits and urged users to review every PKGBUILD and install-script change. A second wave reported in July led Arch to temporarily halt package adoptions.
A familiar or orphaned package can receive a malicious update through the same workflow as an ordinary version bump. Manual review does not scale, but an unexplained “AI says safe” result is not a useful substitute. This project surfaces unusual changes while retaining enough evidence for a person to verify each result.
update-indexdownloads current AUR metadata and appends newly seen package versions to SQLite.checkselects current, unchecked versions, clones each package-base repository, and records its commit,PKGBUILD, and diff.- OpenAI, Anthropic, OpenRouter, the Claude CLI, or the Codex CLI reviews the package in repository context.
- The verdict and supporting evidence are stored separately from package metadata and exposed through the web interface and API.
Click the screenshot to open the live demo.
The experimental aur-ai-security branch checks every AUR commit since paru's accepted baseline against the hosted API. When any commit is missing remotely, it locally assesses the cumulative baseline-to-current diff using your configured provider and model. It runs after downloading AUR repositories and before executing pre-build commands or starting the build.
These paru.conf options enable remote lookups with a local Codex fallback:
[options]
AurSecurityRemote
# AurSecurityRemoteUrl = https://aur-security.cretezy.com
AurSecurityProvider = codex
AurSecurityModel = gpt-5.6-luna
# SkipSafeReviews
# SkipAurSecurityAurSecurityRemoteUrl is optional and defaults to the hosted service. Omit AurSecurityRemote to use local assessment only. AurSecurityProvider accepts openai, anthropic, openrouter, claude, or codex; AurSecurityModel is the corresponding model identifier described in AI providers. API providers require their matching environment variable, while claude and codex require their corresponding installed and authenticated CLI.
One aggregate assessment is printed per package before the transaction table, whose verbose form includes a security-status column. A package is safe only when the whole range is covered and safe; dangerous outranks suspicious, which outranks unavailable coverage. Before review, paru asks whether safely assessed packages should be skipped; SkipSafeReviews makes skipping them the default answer and advances paru's accepted Git baseline. Suspicious, dangerous, unreviewed, and failed assessments remain in the normal review flow. With --noconfirm, a dangerous verdict aborts the transaction. SkipAurSecurity or --skipaursecurity disables the integration.
Checks return one of three verdicts:
safefor ordinary packaging behaviorsuspiciouswhen a concrete concern needs human reviewdangerouswhen there is strong evidence of malicious behavior
The prompt accounts for provenance. A version and checksum bump from the same upstream source is usually normal; a changed domain, repository owner, or download mechanism warrants more scrutiny, as do obfuscated commands, credential access, persistence, and privilege escalation.
This is a review aid, not proof that a package is safe. It does not analyze downloaded binaries and can produce false positives or miss malicious behavior. Inspect suspicious changes, repository history, and upstream provenance before installing an AUR package.
You need Rust, Cargo, Git access to aur.archlinux.org, and either API credentials or an installed and authenticated Claude Code or Codex CLI.
Download the current AUR index:
cargo run -p aur_ai_security -- update-indexPreview packages modified during the last day without cloning repositories or calling a provider:
cargo run -p aur_ai_security -- check --dry-run \
--provider openai \
--model gpt-5.6-luna \
--since 24hRun checks with OpenAI:
export OPENAI_API_KEY="your-api-key"
cargo run -p aur_ai_security -- check \
--provider openai \
--model gpt-5.6-luna \
--filter 010editor spotifyThe default database is sqlite.db. Override it with the global option:
cargo run -p aur_ai_security -- --database data/aur-ai-security.sqlite update-indexFor release binaries, run cargo build --release. This produces target/release/aur_ai_security and target/release/aur_ai_security_web.
update-index downloads packages-meta-v1.json.gz and records the current version of every AUR package. New versions are appended; older versions remain as history but are marked non-current. Seeing the same package and version again refreshes its metadata.
Stored metadata includes package and package-base identifiers, version, submitter, last-modified time, popularity, snapshot path, and first-seen, last-seen, and current-version state.
check reviews current package versions that have not already been checked with the selected provider and model:
cargo run -p aur_ai_security -- check --provider <PROVIDER> --model <MODEL> [OPTIONS]Supported providers are openai, anthropic, openrouter, claude, and codex. Useful filters include:
# Exact package names
--filter 010editor spotify visual-studio-code-bin
# Relative time
--since 30m
--since 12h
--since 7d
# Unix timestamp, relative seconds, RFC 3339, or date
--since 1773703418
--since -30
--since 2026-03-17T12:00:00Z
--since 2026-03-17--since uses the package's AUR LastModified timestamp and composes with --filter and --dry-run. Timestamps without an explicit timezone are interpreted as UTC.
| Provider | Authentication | Model argument |
|---|---|---|
| OpenAI | OPENAI_API_KEY |
OpenAI model name |
| Anthropic | ANTHROPIC_API_KEY |
Anthropic model name |
| OpenRouter | OPENROUTER_API_KEY |
Usually provider/model |
| Claude CLI | Installed and authenticated Claude Code CLI | Claude model name or alias |
| Codex CLI | Installed and authenticated Codex CLI | Codex model name |
The API providers use Rig. Their only repository tool, read_file, can inspect UTF-8 text files up to 128 KiB inside the clone; absolute paths, parent traversal, and symlinks resolving outside the clone are rejected. Structured-output support through OpenRouter depends on the upstream model.
The Claude provider runs claude from the clone in a non-persistent safe-mode session. It ignores project and user customizations, denies interactive permission requests, limits repository access to the built-in Read, Glob, and Grep tools, and supplies the assessment JSON schema. The Codex provider runs codex exec from the clone in an ephemeral session. It ignores user configuration, disables shell tools and web search, and supplies the same schema.
Each successful check stores the verdict and explanation, provider and model, checked Git commit, complete PKGBUILD, diff from the commit's first parent, and check timestamp. Checks are unique per package version, provider, and model.
The shared database crate runs migrations automatically when either application starts. Its main tables are:
package_versions: historical AUR metadata keyed by package name and versionchecks: AI assessments linked to package-version rows
After changing the schema during development, delete the local database and run update-index to create a fresh one.
The Topcoat web application reads the same SQLite database as the CLI. Install the development CLI and start it from the workspace root:
cargo install topcoat-cli
topcoat dev --package aur_ai_security_webIt listens on http://127.0.0.1:3000 by default. Use HOST, PORT, and AUR_AI_SECURITY_DATABASE to customize the server. The interface provides package search, verdict filters, check history, complete PKGBUILDs, and highlighted diffs.
The JSON API includes POST /api/v1/checks/lookup for batch assessment lookup by package base and ordered commit list.
For production, bundle the generated assets before starting the server:
cargo build --release -p aur_ai_security_web
topcoat asset bundle --release --package aur_ai_security_web
./target/release/aur_ai_security_web --database sqlite.dbchecker(aur_ai_security_checker): repository cloning, evidence collection, and AI assessmentdb(aur_ai_security_db): SQLite connection, migrations, and queriescli(aur_ai_security): indexing, candidate selection, and result persistenceweb(aur_ai_security_web): package search and assessment browsing
The CLI and web application share the database crate; the checker is independent of clap, SQLx, and the index database.
cargo test --workspace --locked
cargo clippy --workspace --locked --all-targets -- -D warnings
cargo fmt --allLogging defaults to INFO. Use RUST_LOG=debug or a crate-specific filter such as RUST_LOG=aur_ai_security_checker=debug,aur_ai_security=info. SQLx remains at INFO and Rig at WARN under the broad debug filter; opt in with sqlx=debug or rig_core=debug when needed. Prompts and file contents are not logged.
Licensed under the GNU General Public License v3.0.