Detection Codes

Name: AUR Security Scanner
Author: Kief Studio

Every code below comes from the scanner’s authoritative catalog — one unique, audit-enforced index. Run aur-scan codes locally, or aur-scan explain <CODE> for full detail. Add your own in Custom Rules.

167 codes across 13 categories. Generated from the catalog; do not edit by hand.

CRITICAL severity

Code	Name	Category	Detector	CWE
`ATOMIC-001`	Atomic Arch malicious npm/bun package	Malicious Code	rules	CWE-506
`ATOMIC-002`	Node/Bun package manager in install hook	Malicious Code	rules	CWE-494
`ATOMIC-003`	eBPF rootkit / payload artifact	Persistence	rules	CWE-506
`ATOMIC-004`	Sudo shim in user local bin	Malicious Code	rules	CWE-506
`BIN-002`	Prebuilt binary executed during the build	Malicious Code	binary	CWE-506
`BIN-003`	Prebuilt eBPF object	Malicious Code	binary	CWE-506
`BROWSER-001`	Browser profile access	Credential Theft	rules	CWE-522
`BROWSER-002`	Browser database access	Credential Theft	rules	CWE-522
`CRED-001`	SSH key access	Credential Theft	rules	CWE-522
`CRED-002`	GPG key access	Credential Theft	rules	CWE-522
`CRED-003`	Password file access	Credential Theft	rules	CWE-522
`CRED-005`	Keyring / wallet access	Credential Theft	rules	CWE-522
`CRYPTO-001`	Mining pool connection	Cryptomining	rules	CWE-506
`CRYPTO-002`	Cryptominer binary	Cryptomining	rules	CWE-506
`CRYPTO-003`	Monero/Bitcoin wallet address	Cryptomining	rules	CWE-506
`DEEP-001`	Decode-and-execute flow	Obfuscation	deep	CWE-506
`DEEP-003`	Unicode bidirectional control characters	Obfuscation	deep	CWE-94
`DLE-001`	Curl pipe to shell	Command Injection	rules	CWE-94
`DLE-002`	Wget pipe to shell	Command Injection	rules	CWE-94
`DLE-003`	Curl output executed	Command Injection	rules	CWE-94
`ENV-001`	LD_PRELOAD manipulation	Malicious Code	rules	CWE-426
`ENV-003`	Shell startup file modification	Persistence	rules	CWE-506
`ESCAPE-001`	Extraction or copy outside the build root	Privilege Escalation	rules	CWE-22
`EXEC-002`	Shell -c command substitution fetch	Malicious Code	rules	CWE-494
`EXEC-REMOTE`	Fetches and runs external code	Malicious Code	remote_exec	CWE-494
`EXFIL-001`	Curl POST data exfiltration	Data Exfiltration	rules	CWE-200
`EXFIL-002`	Netcat data transfer	Data Exfiltration	rules	CWE-200
`EXFIL-003`	Discord/Telegram webhook	Data Exfiltration	rules	CWE-506
`EXFIL-004`	DNS exfiltration	Data Exfiltration	rules	CWE-200
`EXFIL-008`	Slack/Teams webhook exfiltration	Data Exfiltration	rules	CWE-200
`INSTALL-001`	Python execution in install script	Malicious Code	rules	CWE-94
`INSTALL-003`	Network access in install script	Network Security	rules	CWE-494
`INSTALL-004`	Language package manager invoked in install hook	Malicious Code	rules	CWE-494
`IOC-001`	Known indicator-of-compromise match	Malicious Code	ioc	CWE-506
`OBF-012`	Message function redefined to execute its arguments	Obfuscation	deep	CWE-94
`PASTE-001`	Pastebin download	Malicious Code	rules	CWE-506
`PERSIST-001`	Systemd service creation in install	Persistence	rules	CWE-506
`PERSIST-002`	Systemd timer creation	Persistence	rules	CWE-506
`PERSIST-004`	rc.local modification	Persistence	rules	CWE-506
`PERSIST-006`	Systemd masquerading	Persistence	rules	CWE-506
`PERSIST-007`	SSH authorized_keys modified	Persistence	rules	CWE-506
`PERSIST-008`	AI coding assistant config or hook written	Persistence	rules	CWE-506
`PERSIST-009`	pacman hook written outside $pkgdir	Persistence	rules	CWE-506
`PRIV-001`	Sudo usage in a build function	Privilege Escalation	privilege	CWE-250
`PRIV-002`	SUID/SGID bit set in a function	Privilege Escalation	privilege	CWE-732
`PRIV-003`	Sudoers modification	Privilege Escalation	privilege	CWE-250
`PRIV-007`	Privileged account manipulation	Privilege Escalation	rules	CWE-269
`PRIV-008`	Password manipulation	Privilege Escalation	rules	CWE-269
`PRIV-009`	Kernel module loaded from a package-shipped file	Privilege Escalation	privilege	CWE-506
`SCAN-001`	Package file could not be analyzed	Configuration	scanner	CWE-693
`SHELL-001`	Bash reverse shell	Malicious Code	rules	CWE-506
`SHELL-002`	Netcat reverse shell	Malicious Code	rules	CWE-506
`SHELL-003`	Python reverse shell	Malicious Code	rules	CWE-506
`SHELL-004`	Socat shell	Malicious Code	rules	CWE-506
`SHELL-005`	Perl reverse shell	Malicious Code	rules	CWE-94
`SHELL-006`	PHP reverse shell	Malicious Code	rules	CWE-94
`SHELL-007`	Ruby/Lua/AWK reverse shell	Malicious Code	rules	CWE-94
`SHELL-008`	Node.js reverse shell	Malicious Code	rules	CWE-94
`SHELL-009`	OpenSSL-encrypted reverse shell	Malicious Code	rules	CWE-94
`SHELL-010`	Named-pipe (mkfifo) reverse shell	Malicious Code	rules	CWE-94
`SHELL-011`	Busybox/telnet/ncat-ssl shell	Malicious Code	rules	CWE-94
`SQUAT-001`	Package name imitates a trusted name	Malicious Code	squat	CWE-1007
`SQUAT-004`	Package occupies an owned namespace under an unauthorised account	Malicious Code	squat	CWE-1007
`TAMPER-001`	Auth database write	Privilege Escalation	rules	CWE-269
`TAMPER-002`	doas/sudoers nopasswd grant	Privilege Escalation	rules	CWE-269
`TAMPER-005`	PAM tampering	Privilege Escalation	rules	CWE-287
`TAMPER-011`	pacman signature downgrade	Malicious Code	rules	CWE-347
`TAMPER-021`	System-wide git config set to run a program	Malicious Code	rules	CWE-829
`TI-URLHAUS-001`	URLhaus lists a source URL	Malicious Code	threat_intel	CWE-494
`TI-VT-001`	VirusTotal flags a source artifact	Malicious Code	threat_intel	CWE-506

HIGH severity

Code	Name	Category	Detector	CWE
`ATOMIC-006`	npm/bun package installed from a URL or git remote during the build	Malicious Code	rules	CWE-494
`BIN-001`	Prebuilt binary committed in the package directory	Suspicious Metadata	binary	CWE-494
`BIN-004`	Binary searches for libraries in an unsafe location	Privilege Escalation	binary	CWE-426
`CHK-001`	No checksums for sources	Cryptography	checksum	CWE-354
`CHK-005`	All non-VCS sources use SKIP	Cryptography	checksum	CWE-354
`CHK-006`	Checksum count mismatch	Configuration	checksum	-
`CRED-004`	Cloud / CI credential file access	Credential Theft	rules	CWE-522
`CRED-008`	Environment/secret dump	Credential Theft	rules	CWE-522
`DEEP-002`	Large embedded encoded blob	Obfuscation	deep	CWE-506
`DEP-001`	Provides a core package name (dependency confusion)	Suspicious Metadata	metadata	CWE-427
`DEP-003`	Package index/registry override	Dependencies	rules	CWE-494
`DIFF-001`	New findings since the last scan	Suspicious Metadata	diff	-
`DIFF-002`	Package ownership changed	Suspicious Metadata	diff	-
`DIFF-003`	Package fetches from a new upstream	Network Security	diff	CWE-494
`DIFF-004`	Install script added or changed	Persistence	diff	CWE-506
`ENV-002`	PATH manipulation	Malicious Code	rules	CWE-426
`EXEC-006`	sqlite3 shell-command execution	Malicious Code	rules	CWE-94
`EXEC-007`	make reads a Makefile from stdin	Command Injection	rules	CWE-94
`EXFIL-006`	HTTP upload exfiltration	Data Exfiltration	rules	CWE-200
`EXFIL-007`	wget POST exfiltration	Data Exfiltration	rules	CWE-200
`EXFIL-009`	Anonymous file-drop / tunnel host	Data Exfiltration	rules	CWE-200
`FUNC-001`	Network access in a build function	Network Security	pattern	-
`HIDDEN-001`	Hidden file creation in home	Malicious Code	rules	-
`HIDDEN-002`	Tmp directory execution	Malicious Code	rules	-
`HIDDEN-003`	Binary in non-standard location	Malicious Code	rules	-
`INSTALL-002`	Binary execution in install script	Malicious Code	rules	CWE-94
`META-003`	Replaces/conflicts a core or security package	Suspicious Metadata	metadata	CWE-1357
`META-007`	install= cannot be statically resolved	Suspicious Metadata	metadata	CWE-426
`OBF-001`	Base64 decoding	Obfuscation	rules	CWE-506
`OBF-002`	Eval usage	Command Injection	rules	CWE-95
`OBF-003`	Hex-encoded payload	Obfuscation	rules	CWE-506
`OBF-005`	Gzip decode execution	Obfuscation	rules	CWE-94
`OBF-006`	Quote-splitting / character obfuscation	Obfuscation	rules	CWE-506
`OBF-007`	printf character assembly	Obfuscation	rules	CWE-506
`OBF-008`	Alternate-encoding decode	Obfuscation	rules	CWE-506
`OBF-011`	Interpreter here-string execution	Obfuscation	rules	CWE-94
`OBF-020`	Dynamic command name	Obfuscation	rules	CWE-94
`PERSIST-003`	Cron job creation	Persistence	rules	-
`PERSIST-005`	XDG autostart creation	Persistence	rules	-
`PERSIST-010`	udev rule written outside $pkgdir	Persistence	rules	CWE-506
`PERSIST-012`	pacman hook runs a fetch, a shell command or a user/temp path	Persistence	shipped	CWE-506
`PERSIST-014`	udev rule runs a shell command, a fetch or a user/temp path	Persistence	shipped	CWE-506
`PRIV-005`	Kernel module operations	Privilege Escalation	privilege	-
`PRIV-006`	Sudo in an install hook	Privilege Escalation	privilege	CWE-250
`PROV-001`	Package gained risky behavior	Suspicious Metadata	provenance	CWE-506
`SCAN-003`	Archive member escapes the extraction directory	Configuration	scanner	CWE-22
`SCAN-004`	Archive uses structures where tar readers disagree	Configuration	scanner	CWE-436
`SQUAT-002`	Package name is one keystroke from a widely-installed package	Malicious Code	squat	CWE-1007
`SRC-002`	Suspicious source domain	Network Security	source	-
`SRC-003`	Raw IP address in source URL	Network Security	source	-
`SRC-004`	URL shortener in source	Network Security	source	-
`SRC-009`	Obfuscated IP in URL	Network Security	rules	CWE-94
`SRC-010`	Source is a different owner’s copy of the upstream repo	Network Security	source	CWE-494
`SRC-011`	References files outside the package directory	Configuration	rules	CWE-22
`TAMPER-013`	Security control disabled	Malicious Code	rules	CWE-693
`TAMPER-017`	CA trust anchor injection	Malicious Code	rules	CWE-295
`TAMPER-018`	Name resolution configuration modified	Malicious Code	rules	CWE-350
`TAMPER-019`	Per-user git config set to run a program	Malicious Code	rules	CWE-829
`TAMPER-020`	git fsmonitor/hooksPath set from an install script	Malicious Code	rules	CWE-829
`TRUST-001`	pacman keyring poisoning	Malicious Code	rules	CWE-494
`URL-001`	Raw IP in URL	Network Security	rules	-
`URL-002`	URL shortener	Network Security	rules	-
`URL-003`	Dynamic DNS domain	Network Security	rules	-

MEDIUM severity

Code	Name	Category	Detector	CWE
`ATOMIC-005`	Named npm/bun package fetched during the build	Malicious Code	rules	CWE-494
`BIN-005`	Binary contains a packed or encrypted section	Obfuscation	binary	CWE-506
`CHK-002`	MD5 checksums used	Cryptography	checksum	CWE-328
`CHK-003`	SHA1 checksums used	Cryptography	checksum	CWE-328
`CHK-004`	Some sources use SKIP checksum	Cryptography	checksum	CWE-354
`CHK-008`	Malformed or wrong-length checksum	Cryptography	checksum	CWE-354
`CHK-009`	Checksum alignment cannot be determined	Cryptography	checksum	CWE-354
`EXEC-005`	Detached background execution	Malicious Code	rules	CWE-506
`EXFIL-010`	Tor hidden service or local SOCKS proxy	Data Exfiltration	rules	CWE-319
`META-005`	install= points outside the package	Suspicious Metadata	metadata	CWE-426
`META-006`	backup= of a security-sensitive file	Suspicious Metadata	metadata	CWE-426
`META-008`	Install message mentions a privileged command	Suspicious Metadata	pattern	-
`OBF-004`	String concatenation obfuscation	Obfuscation	rules	-
`OWN-002`	Package is orphaned and flagged out-of-date	Suspicious Metadata	ownership	-
`PERSIST-011`	pacman hook triggers on every transaction	Persistence	shipped	CWE-506
`PERSIST-013`	udev rule runs a package-shipped program	Persistence	shipped	CWE-506
`PERSIST-015`	Hook or udev rule content is generated at build time	Persistence	shipped	CWE-506
`PRIV-004`	Capabilities being set	Privilege Escalation	privilege	CWE-250
`SCAN-002`	Opaque local archive: contents not reviewed	Configuration	scanner	CWE-693
`SRC-001`	Insecure source/transport protocol	Network Security	source	CWE-319
`SRC-005`	No sources with a build function	Configuration	source	-
`TRUST-002`	GPG key import at build time	Malicious Code	rules	CWE-494

LOW severity

Code	Name	Category	Detector	CWE
`ATOMIC-007`	npx/exec/bunx runs a package by name during the build	Malicious Code	rules	CWE-494
`META-001`	Provides impersonation	Suspicious Metadata	rules	-
`META-002`	validpgpkeys declared but no signature verified	Suspicious Metadata	metadata	CWE-347
`META-004`	epoch set (forces upgrade over the repo version)	Suspicious Metadata	metadata	-
`OWN-001`	Package is orphaned	Suspicious Metadata	ownership	-
`OWN-003`	Flagged out-of-date for over a year	Suspicious Metadata	ownership	-
`OWN-004`	New package with no community validation	Suspicious Metadata	ownership	-
`SQUAT-003`	Build variant is in different hands from its base	Suspicious Metadata	squat	-
`SRC-006`	VCS source from non-standard host	Network Security	source	-
`SRC-007`	VCS source not pinned to a commit	Network Security	source	CWE-494
`SRC-008`	Source host differs from upstream url host	Network Security	source	-

INFO severity

Code	Name	Category	Detector	CWE
`TI-UNCHECKED-001`	Threat-intel lookups incomplete	Configuration	threat_intel	-