Help with AUR Update

I was updating my CachyOS system. Copied the AUR diff and (still learning linux, so…) asked Claude if it can find anything malicious with the context of Arch AUR malware attack. Package in question is librtmp0 [https://aur.archlinux.org/packages/librtmp0] Claude said librtmp0’s Maintainer changed from “Maxime Gauduin” → “Damglador”. And that I should watch out. It also said that something is fishy about version bump. ::: spoiler What I asked with the context of recent arch aur malware incident, check if the following are malicious. Aur (4) Old Version New Version Make Only aur/lib32-gstreamer 1.28.4-1 1.28.5-1 No aur/lib32-gst-plugins-base-libs 1.28.4-1 1.28.5-1 No aur/lib32-libpng12 1.2.59-3 1.2.59-4 No aur/librtmp0 2.4-7 2.6-1 No :: Proceed to review? [Y/n]: :: Downloading PKGBUILDs... (1/1) lib32-gstreamer-1.28.5-1 (lib32-gstreamer lib [-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] Paging with less. Press 'q' to quit or 'h' for help. :: lib32-gstreamer: PKGBUILD | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/PKGBUILD b/PKGBUILD index 5d61e88..72db7e0 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -9,7 +9,7 @@ pkgname=( lib32-gst-plugins-base lib32-gst-plugins-good ) -pkgver=1.28.4 +pkgver=1.28.5 pkgrel=1 pkgdesc="Multimedia graph framework (32-bit)" url="https://gstreamer.freedesktop.org/" @@ -81,7 +81,7 @@ source=( "git+https://gitlab.freedesktop.org/gstreamer/gstreamer.git?signed#tag=%24pkgver" 0001-HACK-meson-Disable-broken-tests.patch ) -b2sums=('3a8a3d89bfc9be8b2b1cbd24b6e7e1dbea25c4619045dd97df4631b94ad5d59d9ac54ffc54eccdec10b0195aee87e0dadd8f560e5cdc499dee99b033d141f7e9' +b2sums=('af4c921e40f58cd61d62dfc1420dfd4d9c0b678f8c17f9504b5f3b6fdbdbd81139a9e5c4397453795ab9fd57f6212f3eee672fc27ad37a4c2f241560dec5c1cd' 'f6c0042f2d171d93f3aadc5fed50fa4a83a901371ce914cb44d614ac0510e0c5c2e10334a9011acad80f86ab08d7a953cce8d331660bca49bbfcaabbce9bee6b') validpgpkeys=( D637032E45B8C6585B9456565D2EEE6F6F349D7C # Tim Müller :: librtmp0: PKGBUILD | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/PKGBUILD b/PKGBUILD index bd5f514..1016d72 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -1,4 +1,5 @@ -# Maintainer: Maxime Gauduin +# Maintainer: Damglador +# Contributor: Maxime Gauduin # Contributor: Bartłomiej Piotrowski # Contributor: xduugu # Contributor: Elis Hughes @@ -6,8 +7,8 @@ # Contributor: Arthur Skowronek pkgname=librtmp0 -pkgver=2.4 -pkgrel=7 +pkgver=2.6 +pkgrel=1 pkgdesc='Toolkit for RTMP streams' arch=('x86_64') url='https://rtmpdump.mplayerhq.hu/' :: lib32-libpng12: LICENSE: Copyright Arch Linux Contributors Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted. THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. PKGBUILD: # Maintainer: Maxime Gauduin # Contributor: Arthur Zamarin # Contributor: trya # Contributor: Jan de Groot # Contributor: dorphell # Contributor: Travis Willard # Contributor: Douglas Soares de Andrade pkgname=lib32-libpng12 pkgver=1.2.59 pkgrel=4 pkgdesc='A collection of routines used to create PNG format graphics files' arch=('x86_64') url='http://www.libpng.org/pub/png/libpng.html' license=('custom') depends=('lib32-glibc' 'lib32-zlib' 'lib32-gcc-libs') makedepends=('gcc-multilib') source=("https://sourceforge.net/projects/libpng/files/libpng-$%7Bpkgver%7D.tar.xz"{,.asc} "https://sourceforge.net/projects/libpng-apng/files/libpng12/$%7Bpkgver%7D/libpng-$%7Bpkgver%7D-apng.patch.gz") validpgpkeys=('8048643BA2C840F4F92A195FF54984BFA16C640F') # Glenn Randers-Pehrson sha256sums=('b4635f15b8adccc8ad0934eea485ef59cc4cae24d0f0300a9a941e51974ffcc7' 'SKIP' '281fd5f0165762967a18302dca217de3212be4a3437f95805be44f1ac9db1a5d') prepare() { cd libpng-${pkgver} patch -Np1 -i ../libpng-${pkgver}-apng.patch libtoolize --force --copy aclocal autoconf automake --add-missing } build() { cd libpng-${pkgver} export CC='gcc -m32' export PKG_CONFIG_PATH='/usr/lib32/pkgconfig' ./configure \ --prefix='/usr' \ --libdir='/usr/lib32' make } package() { cd libpng-${pkgver} make DESTDIR="${pkgdir}" install rm -rf "${pkgdir}"/usr/{bin,include,lib32/{libpng.{a,so},pkgconfig},share} install -Dm 644 LICENSE -t "${pkgdir}"/usr/share/licenses/lib32-libpng12/ } # vim: ts=2 sw=2 et: REUSE.toml: version = 1 [[annotations]] path = [ "PKGBUILD", "README.md", "keys/**", ".SRCINFO", ".nvchecker.toml", "*.install", "*.sysusers", "*.tmpfiles", "*.logrotate", "*.pam", "*.service", "*.socket", "*.timer", "*.desktop", "*.hook", ] SPDX-FileCopyrightText = "Arch Linux contributors" SPDX-License-Identifier = "0BSD" (END) ::: ::: spoiler What I got ## Assessment of These AUR Packages Based on the recent “Atomic Arch” malware campaign from June 2026, I can provide you with an analysis: | Package | Status | Risk Level | Notes | |---------|--------|-----------|-------| | lib32-gstreamer | Safe | Low | Simple version bump (1.28.4 → 1.28.5), b2sum hash updated cleanly. No new dependencies. | | lib32-gst-plugins-base-libs | Safe | Low | Version bump only, same pattern as gstreamer. | | lib32-libpng12 | Safe | Low | Minor pkgrel bump (3 → 4). Full PKGBUILD shown—no malicious npm packages or suspicious install hooks. | | librtmp0 | ⚠️ Requires Review | Medium | Maintainer changed from “Maxime Gauduin” → “Damglador”. This is exactly the attack pattern used in Atomic Arch (package adoption by new maintainers). Full PKGBUILD content not shown in your diff. | — ## Key Findings ### The “Atomic Arch” Campaign Context The June 2026 incident targeted orphaned AUR packages through maintainer takeovers. <citation src=“2,4,5”>Attackers adopted abandoned packages and injected malicious npm dependencies (atomic-lockfile, js-digest, lockfile-js) that steal credentials, SSH keys, GitHub tokens, and developer environment secrets.</citation> <citation src=“4,5”>Over 1,500 packages were ultimately compromised across multiple waves.</citation> ### What to Look For The malware signatures included: - New npm dependencies added to depends() or install hooks (e.g., npm install atomic-lockfile) - Preinstall hooks like "preinstall": "./lib/install-deps.mjs" in npm packages - Maintainer changes on previously stable packages (potential adoption by attackers) ### Your Packages Safe packages: The three gstreamer and libpng packages show only version bumps and hash updates—no new dependencies, no npm installs, no suspicious hooks. These are routine upstream updates. Flagged package: librtmp0 shows a maintainer change, which aligns with the Atomic Arch attack vector. However, the diff you provided doesn’t show the complete PKGBUILD or new dependencies. You need to verify: 1. Whether the version bump to 2.6 and the maintainer change are legitimate 2. Whether any new depends() or install hooks were added (not visible in your diff) 3. Check the full PKGBUILD for npm install commands or suspicious scripts — ## Recommendation Proceed cautiously. Install the first three packages if your normal update cycle includes them. For librtmp0, run a full PKGBUILD review before proceeding—look at the complete file for any added dependencies or install hooks. Cross-reference with the AUR malware check tools [https://github.com/lenucksi/aur-malware-check] to confirm whether librtmp0 appears on any known-compromised lists. ::: So, I am seeking your help. Should I proceed with the update?