Ozan Özdil
EN

Machine translation from Turkish (Cloudflare Workers AI), not reviewed by the author. Read the Turkish original

← Posts

9 Original Cybersecurity and Developer Extensions for the Omarchy Linux Desktop Ecosystem

Score —

An architectural breakdown of open-source cyber defense, hardware security, and developer productivity tools developed for the Arch Linux-based Omarchy environment.

· 3 min read
Contents

Summary: Nine plugins written for Omarchy are introduced one by one: BadUSB Shield, which catches USB attacks; Auth Watch, which monitors sudo and SSH attempts; Tripwire Vault with canary files; DNS Leak Guard; Ghost MAC; OpSec Cleaner; CVE Radar; Cyber Sentinel; and Git Radar for developers. Each is MIT-licensed and comes with its own repository.

To bring the desktop experience together with enterprise security standards in the Linux and open source world, we developed and released as open source 9 original cybersecurity and developer plugins and 4 official desktop themes specifically for the Omarchy ecosystem, a modern Arch Linux desktop environment.

All the developed plugins have been submitted to the official Omarchy Plugin Marketplace (plugins.omarchy.org) directory and are completely free and independent under the MIT license.

1. Cybersecurity, OPSEC and Hardware Shield Plugins

BadUSB Shield (Hardware Watchdog and USB Security)

It monitors all USB data paths connected to the system in real time. It instantly detects and restricts access for devices that look like an innocent storage unit but are presented in the background as a keyboard/HID and automatically inject malicious commands (BadUSB / Rubber Ducky attacks).

Auth Watch (SSH and Sudo Unauthorized Login Tracking)

It filters failed sudo password attempts on the system and SSH intrusion / brute-force attempts from external networks in real time, generating instant alerts in the notification area.

Tripwire Vault (Canary File and Ransomware Trap)

It places cryptographic canary (honey-token) files in critical system and user directories. The moment any unauthorized process or ransomware touches these files, it freezes the process and triggers the emergency protocol.

DNS Leak Guard (DNS Leak and DoT Verifier)

It checks whether system DNS queries are leaking in plain text to the local internet service provider. It continuously tests the DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH) encryption tunnel to secure network privacy.

Ghost MAC (Wi-Fi Hardware Identity Masking)

On public or shared Wi-Fi networks, it dynamically masks your physical hardware address (MAC) and network hostname with fake identities, making physical location and device tracking harder.

OpSec Cleaner (Digital Metadata Cleaner)

It is a digital hygiene tool that zeroes out GPS coordinates, camera serial numbers, capture timestamps and device traces on documents or images before they are transferred to the network.

CVE Radar (Package and Binary Vulnerability Audit)

With Arch Linux official Security Tracker API integration, it scans the 1,100+ installed packages and SUID-privileged system binaries on the system and reports known vulnerabilities instantly.

Cyber Sentinel (Live Network Radar and Port Monitor)

It monitors all active network sockets open to external networks. It offers the ability to terminate the process with a single command for sessions going to non-standard ports or suspicious IP blocks.

2. Developer and Productivity Tools

Git Radar (Repository Pulse and Commit Heat Map)

It audits the working status in local repositories; it visualizes unupdated files, uncommitted changes and the commit distribution of the last 7 days directly in the top panel.

3. Open Source License and Installation

All the developed modules are open to community use under the MIT license. They can be installed directly via the package manager and Git in the Omarchy environment.

My reading

  • Desktop security can be built layer by layer with small tools: each plugin focuses on a single threat.
  • The warning must be in a visible place: the plugins surface findings directly in the top bar and notification area.
  • An open license makes auditing easy: all plugins are MIT licensed and their source code is open.

Resources