I opened Ubuntu's App Center, scrolled through ~90 installed packages, and asked the obvious question: is any of this malware?
The list looked suspicious in all the wrong ways. A font package last updated nine years ago. A dozen unlabeled GStreamer plugins with generic gray icons. Something called BRLTTY I had no memory of installing. Plenty of surface area for paranoia.
None of it turned out to matter, and the reason is worth writing down: App Center is a package browser, not an inventory. It shows you the two sources it manages — the Ubuntu archive and the Snap Store — and nothing else. Every path an attacker would actually use to get code onto a developer workstation is invisible to it.
This is the audit I ran instead, and what each command is actually good for.
Reading the GUI correctly first
