Hall of Fame -- Real-world impact of using `aurscan` in the wild

[HaleTom]

I'm slowly working through my backlog of my held-back AUR updates, and aurscan has highlighted some good results!

I've passed them to the PKGBUILD maintainers:

• oh-my-pi
• openchamber
• tmuxai-bin

What do you think about keeping this issue open as a "Hall of Fame" for the AUR improvements that have come about due to this tool?

[manticore-projects]

  scanning oh-my-pi (6 files) ...

[  OK  ] oh-my-pi  confidence 78%
         This PKGBUILD builds oh-my-pi from a tagged upstream git source using bun and rustup, which is normal for this type of project. The 'bun install --frozen-lockfile' invocation is a legitimate build step for a JavaScript/TypeScript project, not an unrelated package manager call, and there are no signs of credential theft, remote payload execution, or suspicious exfiltration.
         [warning] PKGBUILD: The primary git source uses SKIP for its checksum, which is normal for VCS sources in AUR (git clone is pinned by tag, not hash). However, tag-based pinning is weaker than commit-hash pinning since tags can be force-pushed. The two patch files do have proper checksums.
             > sha256sums=('SKIP'
         [info] PKGBUILD: This is a legitimate build step for the oh-my-pi TypeScript project itself (not an unrelated package install). The --frozen-lockfile flag prevents unexpected dependency changes. This is standard practice for JS/TS projects and is not the Atomic Arch campaign pattern (which installs unrelated npm/bun packages in post-install hooks).
             > bun install --frozen-lockfile
         [info] PKGBUILD: The build conditionally installs a Rust toolchain via rustup at build time, which is somewhat unusual but not malicious — it installs the toolchain specified in the upstream project's rust-toolchain.toml.
             > rustup toolchain install "${_toolchain}"
         [info] tree-sitter-haskell-new-repo.patch: Redirects a Cargo dependency from crates.io to a GitHub git source with a specific commit hash. The target repo (tree-sitter-grammars org) is a legitimate maintained fork. The commit is pinned by hash, reducing risk.
             > source = "git+https://github.com/tree-sitter-grammars/tree-sitter-haskell?branch=master#98aedbd
         [info] PKGBUILD: Executes the freshly-built binary during package() to generate shell completions. This runs in fakeroot context and only writes into pkgdir/srcdir, which is acceptable behavior.
             > _install_completions "${pkgdir}/usr/bin/omp"
         ↳ tokens: 5,457 in / 698 out · $0.0268

scanner usage: 1 call(s) · tokens: 5,457 in / 698 out · $0.0268
All scanned packages look clean.  (heuristic scan — not a guarantee)

Please help me out, what is the problem here?

[manticore-projects]

Eventually I will scan all AUR packages at my own cost although I wonder if the yields in a tax reduction.

[HaleTom]

Please help me out, what is the problem here?

Please see #54.