Security Scan

An Omarchy bar-widget plugin that shows a live security badge in your bar. Runs system-wide scans on a 6-hour timer and lets you trigger manual re-scans or per-project one-shot scans from a click-through popup.

Features

• Live badge: green when clean, amber on warnings, red when compromised
• Popup breakdown per scanner with last-scan timestamp, and a "next scan in Xh" line (or "skipped Xm ago (game active)" when GameMode preempted a run)
• Manual "Scan now" button in popup
• Per-project one-shot scan buttons (bun-check, bumblebee)
• All scanners are optional except persistence — sections only appear when the tool is installed
• AUR-Malware and persistence detail views: "View detail" opens a breakdown of every failed/warned check, grouped by the package or reason behind it when one can be identified (an infected package name, an /etc/hosts comment, the package owning a flagged file). Findings from heuristic checks (not the ones that are direct evidence of an actual compromise) can be dismissed as a reviewed false positive — dismissed findings stay visible, dimmed, with a one-click undo, and stop counting toward the badge color until the underlying finding changes
• Scan history: a compact, capped log of past scans (clock icon in the header), so a one-off finding that's since cleared still left a trace instead of just vanishing on the next overwrite
• Desktop notification on genuinely new active findings (fingerprint-tracked, so already-seen or already-dismissed ones stay quiet) — the badge color alone is invisible to anyone not already looking at the bar
• Skips the scheduled scan while GameMode reports an active game (rather than competing for CPU/IO or silently going stale), and says so in the popup instead of just looking like it stopped running
• Panel follows the same design language as Omarchy's own bar panels (Audio, Network, Bluetooth...): keyboard navigation (Escape closes, Tab switches between bar panels), themed colors, same section-spacing conventions

Scanners

Scanner	What it checks	How to install
AUR-Malware	Atomic Arch IOC scan — pacman/AUR packages, npm/bun caches, eBPF rootkit artifacts, hidden processes	Clone AUR-Malware to ~/.local/share/AUR-Malware/ (the original Atomic-Arch/AUR-Malware this pointed at is gone; this fork ships the same check-atomic-arch_new.sh)
bumblebee	Endpoint package inventory across npm, pypi, go, rubygems, homebrew, etc.	GOBIN=$HOME/.local/bin go install github.com/perplexityai/bumblebee@latest
bun-check	Per-project dev-env one-shot scan (opens a terminal picker)	Bundled — run install.sh after adding the plugin
persistence	Bash-only, no install step. Scans autostart .desktop entries, user systemd units and crontab for the same injection pattern (curl|bash, eval "$(curl...)", etc.) AUR-Malware already checks shell configs for	Always active

The bun-check one-shot script (qs-bun-check-oneshot.sh) is included in this repo. After omarchy plugin add, run the optional install step:

bash ~/.config/omarchy/plugins/io.github.elynch303.security-scan/install.sh

This copies the script to ~/.local/bin/ (prompts to confirm). Pass --bun-check or --no-bun-check to skip the prompt.

Scanner paths can be overridden with environment variables:

QS_SEC_AUR_MALWARE=/path/to/check-atomic-arch_new.sh
QS_SEC_BUMBLEBEE=bumblebee
QS_SEC_BUMBLEBEE_CATALOG=~/.local/share/qs-security/threat-intel
QS_BUN_CHECK=/path/to/bun-checkV2.sh
QS_SEC_STATUS_FILE=~/.cache/qs-security-status.json
QS_SEC_LAST_RUN_FILE=~/.cache/qs-security-last-run.json
QS_SEC_HISTORY_FILE=~/.local/share/qs-security/history.json
QS_SEC_NOTIFIED_FILE=~/.config/qs-security/notified.json
QS_SEC_DISMISSED_FILE=~/.config/qs-security/dismissed.json

How it works

The widget reads ~/.cache/qs-security-status.json, written by ~/.local/bin/qs-security-scan.sh. Wire that script into a systemd timer to run every 6 hours:

# ~/.config/systemd/user/qs-security-scan.timer
[Unit]
Description=Periodic security scan for omarchy bar

[Timer]
OnBootSec=2min
OnUnitActiveSec=6h

[Install]
WantedBy=timers.target

# ~/.config/systemd/user/qs-security-scan.service
[Unit]
Description=Security scan for omarchy bar

[Service]
Type=oneshot
ExecCondition=/bin/sh -c 'command -v gamemoded >/dev/null 2>&1 || exit 0; gamemoded -s 2>/dev/null | grep -q inactive'
ExecStart=%h/.local/bin/qs-security-scan.sh
Nice=19
IOSchedulingClass=idle

ExecCondition skips a scheduled run (without counting it as a failure) while GameMode reports an active client, so the scan doesn't start mid-session and compete for CPU/IO. Nice=19/IOSchedulingClass=idle cover the case where a game launches after a scan is already running, so it yields resources instead of competing for them. Both are no-ops if gamemoded isn't installed.

systemctl --user enable --now qs-security-scan.timer

Installation

omarchy plugin add https://github.com/elynch303/security-scan.git

Then add it to your bar layout in ~/.config/omarchy/shell.json:

{ "id": "io.github.elynch303.security-scan" }

Requirements

• Omarchy with Quickshell
• At least one of the three supported scanners (widget gracefully shows a setup notice if none are installed)

License

MIT