I was updating my CachyOS system. Copied the AUR diff and (still learning linux, so..) asked Claude if it can find anything malicious with the context of Arch AUR malware attack.
Package in question is librtmp0
Claude said librtmp0's Maintainer changed from "Maxime Gauduin" → "Damglador". And that I should watch out. It also said that something is fishy about version bump.
What I asked
with the context of recent arch aur malware incident, check if the following are malicious.
Aur (4) Old Version New Version Make Only
aur/lib32-gstreamer 1.28.4-1 1.28.5-1 No
aur/lib32-gst-plugins-base-libs 1.28.4-1 1.28.5-1 No
aur/lib32-libpng12 1.2.59-3 1.2.59-4 No
aur/librtmp0 2.4-7 2.6-1 No
:: Proceed to review? [Y/n]:
:: Downloading PKGBUILDs...
(1/1) lib32-gstreamer-1.28.5-1 (lib32-gstreamer lib [-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------]
Paging with less. Press 'q' to quit or 'h' for help.
:: lib32-gstreamer:
PKGBUILD | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/PKGBUILD b/PKGBUILD
index 5d61e88..72db7e0 100644
***
a/PKGBUILD
+++ b/PKGBUILD
@@ -9,7 +9,7 @@ pkgname=(
lib32-gst-plugins-base
lib32-gst-plugins-good
)
-pkgver=1.28.4
+pkgver=1.28.5
pkgrel=1
pkgdesc="Multimedia graph framework (32-bit)"
url="https://gstreamer.freedesktop.org/"
@@ -81,7 +81,7 @@ source=(
"git+https://gitlab.freedesktop.org/gstreamer/gstreamer.git?signed#tag=%24pkgver"
0001-HACK-meson-Disable-broken-tests.patch
)
-b2sums=('3a8a3d89bfc9be8b2b1cbd24b6e7e1dbea25c4619045dd97df4631b94ad5d59d9ac54ffc54eccdec10b0195aee87e0dadd8f560e5cdc499dee99b033d141f7e9'
+b2sums=('af4c921e40f58cd61d62dfc1420dfd4d9c0b678f8c17f9504b5f3b6fdbdbd81139a9e5c4397453795ab9fd57f6212f3eee672fc27ad37a4c2f241560dec5c1cd'
'f6c0042f2d171d93f3aadc5fed50fa4a83a901371ce914cb44d614ac0510e0c5c2e10334a9011acad80f86ab08d7a953cce8d331660bca49bbfcaabbce9bee6b')
validpgpkeys=(
D637032E45B8C6585B9456565D2EEE6F6F349D7C # Tim Müller
:: librtmp0:
PKGBUILD | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/PKGBUILD b/PKGBUILD
index bd5f514..1016d72 100644
***
a/PKGBUILD
+++ b/PKGBUILD
@@ -1,4 +1,5 @@
-# Maintainer: Maxime Gauduin
+# Maintainer: Damglador
+# Contributor: Maxime Gauduin
# Contributor: Bartłomiej Piotrowski
# Contributor: xduugu
# Contributor: Elis Hughes
@@ -6,8 +7,8 @@
# Contributor: Arthur Skowronek
pkgname=librtmp0
-pkgver=2.4
-pkgrel=7
+pkgver=2.6
+pkgrel=1
pkgdesc='Toolkit for RTMP streams'
arch=('x86_64')
url='https://rtmpdump.mplayerhq.hu/'
:: lib32-libpng12:
LICENSE:
Copyright Arch Linux Contributors
Permission to use, copy, modify, and/or distribute this software for
any purpose with or without fee is hereby granted.
THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL
WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE
FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY
DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
PKGBUILD:
# Maintainer: Maxime Gauduin
# Contributor: Arthur Zamarin
# Contributor: trya
# Contributor: Jan de Groot
# Contributor: dorphell
# Contributor: Travis Willard
# Contributor: Douglas Soares de Andrade
pkgname=lib32-libpng12
pkgver=1.2.59
pkgrel=4
pkgdesc='A collection of routines used to create PNG format graphics files'
arch=('x86_64')
url='http://www.libpng.org/pub/png/libpng.html'
license=('custom')
depends=('lib32-glibc' 'lib32-zlib' 'lib32-gcc-libs')
makedepends=('gcc-multilib')
source=("https://sourceforge.net/projects/libpng/files/libpng-$%7Bpkgver%7D.tar.xz"{,.asc}
"https://sourceforge.net/projects/libpng-apng/files/libpng12/$%7Bpkgver%7D/libpng-$%7Bpkgver%7D-apng.patch.gz")
validpgpkeys=('8048643BA2C840F4F92A195FF54984BFA16C640F') # Glenn Randers-Pehrson
sha256sums=('b4635f15b8adccc8ad0934eea485ef59cc4cae24d0f0300a9a941e51974ffcc7'
'SKIP'
'281fd5f0165762967a18302dca217de3212be4a3437f95805be44f1ac9db1a5d')
prepare() {
cd libpng-${pkgver}
patch -Np1 -i ../libpng-${pkgver}-apng.patch
libtoolize --force --copy
aclocal
autoconf
automake --add-missing
}
build() {
cd libpng-${pkgver}
export CC='gcc -m32'
export PKG_CONFIG_PATH='/usr/lib32/pkgconfig'
./configure \
--prefix='/usr' \
--libdir='/usr/lib32'
make
}
package() {
cd libpng-${pkgver}
make DESTDIR="${pkgdir}" install
rm -rf "${pkgdir}"/usr/{bin,include,lib32/{libpng.{a,so},pkgconfig},share}
install -Dm 644 LICENSE -t "${pkgdir}"/usr/share/licenses/lib32-libpng12/
}
# vim: ts=2 sw=2 et:
REUSE.toml:
version = 1
[[annotations]]
path = [
"PKGBUILD",
"README.md",
"keys/**",
".SRCINFO",
".nvchecker.toml",
"*.install",
"*.sysusers",
"*.tmpfiles",
"*.logrotate",
"*.pam",
"*.service",
"*.socket",
"*.timer",
"*.desktop",
"*.hook",
]
SPDX-FileCopyrightText = "Arch Linux contributors"
SPDX-License-Identifier = "0BSD"
(END)
What I got
Assessment of These AUR Packages
Based on the recent "Atomic Arch" malware campaign from June 2026, I can provide you with an analysis:
| Package |
Status |
Risk Level |
Notes |
| lib32-gstreamer |
Safe |
Low |
Simple version bump (1.28.4 → 1.28.5), b2sum hash updated cleanly. No new dependencies. |
| lib32-gst-plugins-base-libs |
Safe |
Low |
Version bump only, same pattern as gstreamer. |
| lib32-libpng12 |
Safe |
Low |
Minor pkgrel bump (3 → 4). Full PKGBUILD shown—no malicious npm packages or suspicious install hooks. |
| librtmp0 |
⚠️ Requires Review |
Medium |
Maintainer changed from "Maxime Gauduin" → "Damglador". This is exactly the attack pattern used in Atomic Arch (package adoption by new maintainers). Full PKGBUILD content not shown in your diff. |
Key Findings
The "Atomic Arch" Campaign Context
The June 2026 incident targeted orphaned AUR packages through maintainer takeovers. Attackers adopted abandoned packages and injected malicious npm dependencies (atomic-lockfile, js-digest, lockfile-js) that steal credentials, SSH keys, GitHub tokens, and developer environment secrets. Over 1,500 packages were ultimately compromised across multiple waves.
What to Look For
The malware signatures included:
- New npm dependencies added to
depends() or install hooks (e.g., npm install atomic-lockfile)
- Preinstall hooks like
"preinstall": "./lib/install-deps.mjs" in npm packages
- Maintainer changes on previously stable packages (potential adoption by attackers)
Your Packages
Safe packages: The three gstreamer and libpng packages show only version bumps and hash updates—no new dependencies, no npm installs, no suspicious hooks. These are routine upstream updates.
Flagged package: librtmp0 shows a maintainer change, which aligns with the Atomic Arch attack vector. However, the diff you provided doesn't show the complete PKGBUILD or new dependencies. You need to verify:
- Whether the version bump to 2.6 and the maintainer change are legitimate
- Whether any new
depends() or install hooks were added (not visible in your diff)
- Check the full PKGBUILD for npm install commands or suspicious scripts
Recommendation
Proceed cautiously. Install the first three packages if your normal update cycle includes them. For librtmp0, run a full PKGBUILD review before proceeding—look at the complete file for any added dependencies or install hooks. Cross-reference with the AUR malware check tools to confirm whether librtmp0 appears on any known-compromised lists.
So, I am seeking your help. Should I proceed with the update?
