Save a detailed report
Create both a readable report and a structured JSON summary.
aur-response --local --report --jsonRead-only checks for Arch Linux incidents
Find evidence.
Keep control.
Scan installed packages, pacman history, cached build files, runtime state, and persistence points for known AUR supply-chain campaigns. Scans stay read-only. Recovery requires an explicit command.
- Default modeRead-only
- Report formatText and JSON
- Offline dataIntegrity checked
- Exit policyStable codes 0–4
Check your download
Current release v2.2.0
This page displays the SHA-256 checksums published with the current GitHub release. Compare the archive's checksum before you run it.
Download the Linux archive
Linux archive SHA-256
bee0d666a2c5b1a7321da9e9b830afe3854faacfab08205ce8cc6ccc7745938f
Tagged source SHA-256
52f80be250799ddeaab1202ba6dd2f8d48cf61d33beffa9440359c40b5ce5851A matching checksum shows that your download is unchanged from the published file. It does not prove who created the release because GitHub publishes the archive and checksum together.
Open the published checksum fileFirst scan
Check this computer without changing it
Download the latest release on a computer you trust. Open a terminal in the extracted folder, then run the command below. The scan uses the campaign data included with the download and saves a report.
./aur-response --local --reportResponse workflow
Evidence comes before remediation
The toolkit separates detection, triage, and recovery. A finding never turns into a package removal or credential change on its own.
- 01
Verify inputs
Check bundled campaign data against the committed integrity manifest.
- 02
Inspect the host
Read bounded files and adapters without evaluating package build content.
- 03
Write evidence
Record findings, coverage gaps, provenance, and list hashes in stable reports.
- 04
Choose a response
Preview guarded recovery commands before applying a scoped change.
Read the result
The final line tells you what happened
The scan separates confirmed indicators from warnings and missing data. A clean result is trustworthy only when the scan inspected every required source.
Clean
The scan found no known indicator and completed its required checks.
Compromise indicators
The report contains evidence tied to a supported campaign. Preserve the report and isolate the computer from sensitive work.
Warnings
The scan found something that needs review but does not prove compromise.
Insufficient data
The scan could not read a required file or system source. Fix the coverage gap before treating the result as clean.
Your next step
Choose the next step from the result
Read the final status in the report. Then follow only the matching guidance below.
-
Clean
Keep the report
No known indicator was found, and every required check completed. Save the report with the date of the scan. Run a new scan when the project publishes updated campaign data.
-
Warning
Review the named evidence
A warning does not prove compromise. Preserve the report and inspect the file, package, or process named in the finding. Do not remove anything based on the warning alone.
-
Compromise indicators
Stop sensitive work
Keep the report and stop using this computer for passwords, banking, or administrative access. Use a known-clean device to read the campaign guidance and plan recovery.
-
Insufficient data
Complete the missing checks
The report names each source that the scan could not inspect. Fix those access or tool problems, then run the scan again. Do not treat this result as clean.
Choose the next step
Preserve evidence before recovery
Keep the original report. If the scan found compromise indicators, use a known-clean device to change important credentials after you understand the campaign guidance.
Run a shorter follow-up
Check the main locations when a full artifact walk takes too long.
aur-response --local --quick --quiet --fail-on compromisePreview package recovery
See what the recovery command would remove. This preview makes no change.
aur-response recovery remove-packages --local --dry-runThe toolkit never removes a package during a scan. Commands that change the computer require a separate, explicit recovery action.
Campaign registry
Campaigns the toolkit recognizes
Each campaign has its own dates, packages, and indicators. The report names the matching campaign so you can follow the correct response guidance.
Optional deeper look
See what the scan reads and saves
This optional diagram explains which parts of your computer the scan checks and where it saves the report. Implementation details remain in the repository.
Open the interactive architecture diagramBest for tablets, laptops, and desktop screens