with the context of recent arch aur malware incident, check if the following are malicious.


Aur (4) Old Version New Version Make Only
aur/lib32-gstreamer 1.28.4-1 1.28.5-1 No
aur/lib32-gst-plugins-base-libs 1.28.4-1 1.28.5-1 No
aur/lib32-libpng12 1.2.59-3 1.2.59-4 No
aur/librtmp0 2.4-7 2.6-1 No

:: Proceed to review? [Y/n]: 

:: Downloading PKGBUILDs...
(1/1) lib32-gstreamer-1.28.5-1 (lib32-gstreamer lib [-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------]
Paging with less. Press 'q' to quit or 'h' for help.

:: lib32-gstreamer:
PKGBUILD | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/PKGBUILD b/PKGBUILD
index 5d61e88..72db7e0 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -9,7 +9,7 @@ pkgname=(
lib32-gst-plugins-base
lib32-gst-plugins-good
)
-pkgver=1.28.4
+pkgver=1.28.5
pkgrel=1
pkgdesc="Multimedia graph framework (32-bit)"
url="https://gstreamer.freedesktop.org/"
@@ -81,7 +81,7 @@ source=(
"git+https://gitlab.freedesktop.org/gstreamer/gstreamer.git?signed#tag=%24pkgver"
0001-HACK-meson-Disable-broken-tests.patch
)
-b2sums=('3a8a3d89bfc9be8b2b1cbd24b6e7e1dbea25c4619045dd97df4631b94ad5d59d9ac54ffc54eccdec10b0195aee87e0dadd8f560e5cdc499dee99b033d141f7e9'
+b2sums=('af4c921e40f58cd61d62dfc1420dfd4d9c0b678f8c17f9504b5f3b6fdbdbd81139a9e5c4397453795ab9fd57f6212f3eee672fc27ad37a4c2f241560dec5c1cd'
'f6c0042f2d171d93f3aadc5fed50fa4a83a901371ce914cb44d614ac0510e0c5c2e10334a9011acad80f86ab08d7a953cce8d331660bca49bbfcaabbce9bee6b')
validpgpkeys=(
D637032E45B8C6585B9456565D2EEE6F6F349D7C # Tim Müller 

:: librtmp0:
PKGBUILD | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/PKGBUILD b/PKGBUILD
index bd5f514..1016d72 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,4 +1,5 @@
-# Maintainer: Maxime Gauduin 
+# Maintainer: Damglador 
+# Contributor: Maxime Gauduin 
# Contributor: Bartłomiej Piotrowski 
# Contributor: xduugu 
# Contributor: Elis Hughes 
@@ -6,8 +7,8 @@
# Contributor: Arthur Skowronek 

pkgname=librtmp0
-pkgver=2.4
-pkgrel=7
+pkgver=2.6
+pkgrel=1
pkgdesc='Toolkit for RTMP streams'
arch=('x86_64')
url='https://rtmpdump.mplayerhq.hu/'

:: lib32-libpng12:
LICENSE:
Copyright Arch Linux Contributors

Permission to use, copy, modify, and/or distribute this software for
any purpose with or without fee is hereby granted.

THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL
WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE
FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY
DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

PKGBUILD:
# Maintainer: Maxime Gauduin 
# Contributor: Arthur Zamarin 
# Contributor: trya 
# Contributor: Jan de Groot 
# Contributor: dorphell 
# Contributor: Travis Willard 
# Contributor: Douglas Soares de Andrade 

pkgname=lib32-libpng12
pkgver=1.2.59
pkgrel=4
pkgdesc='A collection of routines used to create PNG format graphics files'
arch=('x86_64')
url='http://www.libpng.org/pub/png/libpng.html'
license=('custom')
depends=('lib32-glibc' 'lib32-zlib' 'lib32-gcc-libs')
makedepends=('gcc-multilib')
source=("https://sourceforge.net/projects/libpng/files/libpng-$%7Bpkgver%7D.tar.xz"{,.asc}
"https://sourceforge.net/projects/libpng-apng/files/libpng12/$%7Bpkgver%7D/libpng-$%7Bpkgver%7D-apng.patch.gz")
validpgpkeys=('8048643BA2C840F4F92A195FF54984BFA16C640F') # Glenn Randers-Pehrson
sha256sums=('b4635f15b8adccc8ad0934eea485ef59cc4cae24d0f0300a9a941e51974ffcc7'
'SKIP'
'281fd5f0165762967a18302dca217de3212be4a3437f95805be44f1ac9db1a5d')

prepare() {
cd libpng-${pkgver}

patch -Np1 -i ../libpng-${pkgver}-apng.patch

libtoolize --force --copy
aclocal
autoconf
automake --add-missing
}

build() {
cd libpng-${pkgver}

export CC='gcc -m32'
export PKG_CONFIG_PATH='/usr/lib32/pkgconfig'

./configure \
--prefix='/usr' \
--libdir='/usr/lib32'
make
}

package() {
cd libpng-${pkgver}

make DESTDIR="${pkgdir}" install
rm -rf "${pkgdir}"/usr/{bin,include,lib32/{libpng.{a,so},pkgconfig},share}

install -Dm 644 LICENSE -t "${pkgdir}"/usr/share/licenses/lib32-libpng12/
}

# vim: ts=2 sw=2 et:

REUSE.toml:
version = 1

[[annotations]]
path = [
"PKGBUILD",
"README.md",
"keys/**",
".SRCINFO",
".nvchecker.toml",
"*.install",
"*.sysusers",
"*.tmpfiles",
"*.logrotate",
"*.pam",
"*.service",
"*.socket",
"*.timer",
"*.desktop",
"*.hook",
]
SPDX-FileCopyrightText = "Arch Linux contributors"
SPDX-License-Identifier = "0BSD"

(END)

Assessment of These AUR Packages

Based on the recent “Atomic Arch” malware campaign from June 2026, I can provide you with an analysis:

Key Findings

The “Atomic Arch” Campaign Context

The June 2026 incident targeted orphaned AUR packages through maintainer takeovers. <citation src=“2,4,5”>Attackers adopted abandoned packages and injected malicious npm dependencies (atomic-lockfile, js-digest, lockfile-js) that steal credentials, SSH keys, GitHub tokens, and developer environment secrets.</citation> <citation src=“4,5”>Over 1,500 packages were ultimately compromised across multiple waves.</citation>

What to Look For

The malware signatures included:

• New npm dependencies added to depends() or install hooks (e.g., npm install atomic-lockfile)
• Preinstall hooks like "preinstall": "./lib/install-deps.mjs" in npm packages
• Maintainer changes on previously stable packages (potential adoption by attackers)

Your Packages

Safe packages: The three gstreamer and libpng packages show only version bumps and hash updates—no new dependencies, no npm installs, no suspicious hooks. These are routine upstream updates.

Flagged package: librtmp0 shows a maintainer change, which aligns with the Atomic Arch attack vector. However, the diff you provided doesn’t show the complete PKGBUILD or new dependencies. You need to verify:

1. Whether the version bump to 2.6 and the maintainer change are legitimate
2. Whether any new depends() or install hooks were added (not visible in your diff)
3. Check the full PKGBUILD for npm install commands or suspicious scripts

Recommendation

Proceed cautiously. Install the first three packages if your normal update cycle includes them. For librtmp0, run a full PKGBUILD review before proceeding—look at the complete file for any added dependencies or install hooks. Cross-reference with the AUR malware check tools to confirm whether librtmp0 appears on any known-compromised lists.