Benign arch Download

thurbox 0.152.0-1

Anomalous package hides outbound data exfiltrationAnomalous package runs an obfuscated install hook

SHA-2562ac3b1d9dd0b4b4650da8e0100134f198d6aa145da99fa19a00a165ee2ca2e70

URLhttps://aur.archlinux.org/cgit/aur.git/snapshot/thurbox.tar.gz

Evidence

GitHub archive refs download URL PKGBUILD · lines 1–20

1# Maintainer: LeTuR <[email protected]>
2pkgname=thurbox
3pkgver=0.151.0
4pkgrel=1
5pkgdesc="TUI for orchestrating multiple coding-agent CLI sessions in persistent tmux panels"
6arch=('x86_64' 'aarch64')
7url="https://github.com/Thurbeen/thurbox"
8license=('MIT')
9# tmux/git are required at runtime. sqlite/glibc are the shared libraries
10# the binary links (verified with readelf; gcc-libs is implicitly satisfied).
11# The clipboard backend (arboard) loads X11/Wayland libs lazily, not hard deps.
12depends=('tmux' 'git' 'sqlite' 'glibc')
13makedepends=('cargo')
14optdepends=('claude-code: Claude Code agent CLI'
15            'aider-chat: aider agent CLI'
16            'opencode-bin: opencode agent CLI')
17provides=('thurbox')
18conflicts=('thurbox-bin')
19source=("$pkgname-$pkgver.tar.gz::https://github.com/Thurbeen/thurbox/archive/refs/tags/v$pkgver.tar.gz")
20sha256sums=('960eded538d9ebb033141799dad4bac534710e0ab838a83dccac1d705d775200')

Unattended agent execution mode value windows-test.sh · lines 1–10

1#!/usr/bin/env bash
2#
3# Spin up a throwaway Windows VM (Windows 11) to exercise thurbox's Windows support
4# on top of psmux (the native-Windows tmux clone). Mirrors remote-ssh-test.sh:
5# a single Podman container runs a real, KVM-accelerated Windows VM via
6# dockur/windows, with an unattended first-boot script that installs psmux +
7# OpenSSH so the harness can drive the VM headlessly over SSH — exactly like the
8# Linux remote-SSH test drives its container.
9#
10# All s …

References the user SSH directory windows-test.sh · lines 11–16

11:28…  release zip, the generated /oem setup payload, and
12# the VM disk image. Nothing touches your real ~/.ssh or ~/.config.
13#
14# Usage:
15#   scripts/dev/windows-test.sh up      # build /oem payload + boot the VM (first run installs Windows, ~10-20 min)
16#   scripts/ …

Build image installs a Windows cross-compiler windows-test.sh · lines 38–43

38:61… ease to install in the VM
39#
40# Requires: podman (with /dev/kvm + /dev/net/tun), ssh, ssh-keygen, curl.
41# Cross-build (deploy / test-suite) additionally needs the x86_64-pc-windows-gnu
42# Rust target, the mingw-w64 toolchain, and (for test-suite) cargo-nextest on the
43# host. No Rust toolchain is needed *inside* the VM: test-suite cross-buil …

References a release download URL path windows-test.sh · lines 44–70

44:51… uns it with cargo-nextest.exe.
45
46set -euo pipefail
47
48REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
49WORKDIR="${THURBOX_WIN_TEST_DIR:-$REPO_ROOT/target/windows-test}"
50IMAGE="docker.io/dockurr/windows"
51CONTAINER="thurbox-windows"
⋯6 lines
58WIN_DISK="${THURBOX_WIN_DISK:-64G}"
59PSMUX_VERSION="${PSMUX_VERSION:-v3.3.6}"
60PSMUX_ZIP_URL="https://github.com/psmux/psmux/releases/download/${PSMUX_VERSION}/psmux-${PSMUX_VERSION}-windows-x64.zip"
61NEXTEST_VERSION="${NEXTEST_VERSION:-latest}"
62# get.nexte.st serves a prebuilt cargo-nextest.exe (zip) per platform/version.
63NEXTEST_ZIP_URL="https://get.nexte.st/${NEXTEST_VERSION}/windows"
64WIN_TARGET="x86_64-pc-windows-gnu"
65
66KEY="$WORKDIR/id_ed25519"
67OEM_DIR="$WORKDIR/oem"
68STORAGE_DIR="$WORKDIR/storage"
69
70# VM credentials (the dockur default admin user). Keys are the real auth …

No evidence locations were recorded for this file. Raw result