cyberstars / tools / aurscan
aurscan
—Catch malicious AUR packages before makepkg builds them.
Supply-chain guard for Arch Linux that hooks into yay or paru and feeds a package's PKGBUILD, .install scriptlets, .SRCINFO and helper scripts to an LLM (Claude, Codex or a local model) the moment they are downloaded, blocking the build if the scripts look hostile. Aimed at stopping attacker-controlled sources and disguised payloads before any code runs.