Open source
ks-aur-scanner
An AUR payload runs when makepkg builds the package, so the check has to happen before the build. The PKGBUILD runs on your machine with your permissions before pacman installs a single file. ks-aur-scanner reads it, the install scripts and the sources they fetch, flags what looks wrong, and sits in front of yay or paru so the scan runs every time. It never runs the code to find out.
What it checks
The build script
Downloads piped to a shell, encoded payloads, persistence through services and timers, and npm or bun called from an install hook, the trick behind the Atomic Arch takeovers of June 2026.
The whole tree
Installing one AUR package builds every AUR package it depends on, and a hijacked package is often one of those. The scanner resolves the tree and scans each one.
Signed releases
Stable releases build from a signed git tag that makepkg checks against our key.
In your helper
A hook runs the scan before a build, so you don't have to remember to.
Open source
Install from the AUR
aur-scanner and ks-aur-scanner are the same stable package under two names. Install one of them.
- ks-aur-scanner is released under the GNU GPL, version three.
paru -S aur-scanneraur-scan --help