aur-shield

arch_agent/aur-shield

Fork 0

Commit Graph

Author	SHA1	Message	Date
arch_agent	f6b5ec4031	feat: extended IOC sources + archcanary features Extended IOC sources (from archcanary): - aur-audit.wtako.net black/red API (3rd-party continuous AUR scanner) - Community reports list (community-curated malicious packages) - CHAOS RAT campaign list (backdoor payload) - Russian spam campaign list (.bashrc injection) Client features (archcanary-inspired): - Exit codes: 0=clean, 1=warning, 2=malicious (scriptable) - --doctor health check (server, ollama, repo status) - --scan-only mode (scan without building) - IOC match display in malicious blocks - Suspicious packages: interactive install prompt All IOC fetches run concurrently for speed.	2026-08-04 09:42:02 +02:00
arch_agent	7f46bc8f9a	feat: IOC pre-check via public threat intel (AegisAUR integration) - ioc_fetcher.py: fetches from HedgeDoc, Atomic Arch Gist, Arch Security Tracker, AUR RPC orphan detection (concurrent) - scanner.py: IOC pre-check before LLM scan — known malicious packages get instant MALICIOUS verdict without LLM cost - typosquatting check with Levenshtein distance - server.py: API returns ioc_matches + typosquat_matches - README: threat intel sources documented Sources ported from AegisAUR (Rust) to Python.	2026-08-04 09:39:53 +02:00
arch_agent	adee5dfc78	aur-shield v0.1.0: AI-powered AUR firewall - FastAPI server with scan/build/repo endpoints - LLM scanner (Ollama) with regex pre-scan - makepkg/devtools builder with chroot isolation - Scan cache with TTL + PKGBUILD hash - Client installer + safe-yay wrapper - Docs + config example	2026-08-04 09:35:35 +02:00

Author

SHA1

Message

Date

arch_agent

f6b5ec4031

feat: extended IOC sources + archcanary features

Extended IOC sources (from archcanary):
- aur-audit.wtako.net black/red API (3rd-party continuous AUR scanner)
- Community reports list (community-curated malicious packages)
- CHAOS RAT campaign list (backdoor payload)
- Russian spam campaign list (.bashrc injection)

Client features (archcanary-inspired):
- Exit codes: 0=clean, 1=warning, 2=malicious (scriptable)
- --doctor health check (server, ollama, repo status)
- --scan-only mode (scan without building)
- IOC match display in malicious blocks
- Suspicious packages: interactive install prompt

All IOC fetches run concurrently for speed.

2026-08-04 09:42:02 +02:00

arch_agent

7f46bc8f9a

feat: IOC pre-check via public threat intel (AegisAUR integration)

- ioc_fetcher.py: fetches from HedgeDoc, Atomic Arch Gist, Arch Security
  Tracker, AUR RPC orphan detection (concurrent)
- scanner.py: IOC pre-check before LLM scan — known malicious packages
  get instant MALICIOUS verdict without LLM cost
- typosquatting check with Levenshtein distance
- server.py: API returns ioc_matches + typosquat_matches
- README: threat intel sources documented

Sources ported from AegisAUR (Rust) to Python.

2026-08-04 09:39:53 +02:00

arch_agent

adee5dfc78

aur-shield v0.1.0: AI-powered AUR firewall

- FastAPI server with scan/build/repo endpoints
- LLM scanner (Ollama) with regex pre-scan
- makepkg/devtools builder with chroot isolation
- Scan cache with TTL + PKGBUILD hash
- Client installer + safe-yay wrapper
- Docs + config example

2026-08-04 09:35:35 +02:00

3 Commits