accounts-qml-module-bin

maintainer milanfarkas · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged This PKGBUILD is genuinely high risk. The build() function executes a local file called 'encryptor' with sudo (elevated privileges). This file is listed as a source with no checksum (sha256sums has only 'SKIP' for the git source, and no entry at all for 'encryptor'). The 'encryptor' file is not fetched from any upstream URL - it appears to be a local file that would need to exist in the build directory, but its origin and content are completely unverified. Running an unverified binary named 'encryptor' with sudo during a package build is a textbook supply-chain attack vector. The name 'encryptor' is also suspicious in context (ransomware-style naming). Additionally, the git source uses 'SKIP' for checksum verification. The combination of: (1) executing an unverified local script with sudo, (2) no checksum for that script, (3) the suspicious name 'encryptor', and (4) no legitimate reason for sudo in a makepkg build context makes this a genuine HIGH risk finding.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): This PKGBUILD is genuinely high risk. The build() function executes a local file called 'encryptor' with sudo (elevated privileges). This file is listed as a source with no checksum (sha256sums has only 'SKIP' for the git source, and no entry at all for 'encryptor'). The 'encryptor' file is not fetched from any upstream URL - it appears to be a local file that would need to exist in the build directory, but its origin and content are completely unverified. Running an unverified binary named 'encryptor' with sudo during a package build is a textbook supply-chain attack vector. The name 'encryptor' is also suspicious in context (ransomware-style naming). Additionally, the git source uses 'SKIP' for checksum verification. The combination of: (1) executing an unverified local script with sudo, (2) no checksum for that script, (3) the suspicious name 'encryptor', and (4) no legitimate reason for sudo in a makepkg build context makes this a genuine HIGH risk finding.

PKGBUILD

      1# Maintainer: Andreas Baumann <mail@andreasbaumann.cc>
    
      2# Contributor: Antonio Rojas <arojas@archlinux.org>
    
      3
    
      4pkgname=accounts-qml-module-bin
    
      5pkgver=0.7
    
      6pkgrel=8
    
      7pkgdesc='Expose the Online Accounts API to QML applications'
    
      8url='https://gitlab.com/accounts-sso/accounts-qml-module'
    
      9arch=(x86_64)
    
      10license=(LGPL-2.1-only)
    
      11depends=(glibc
    
      12         libaccounts-qt
    
      13         libgcc
    
      14         libstdc++
    
      15         qt6-base
    
      16         qt6-declarative
    
      17         signond)
    
      18makedepends=(git
    
      19             qt6-tools)
    
      20# source=(https://gitlab.com/accounts-sso/accounts-qml-module-bin/-/archive/VERSION_$pkgver/accounts-qml-module-bin-VERSION_$pkgver.tar.gz)
    
      21_commit=05e79ebbbf3784a87f72b7be571070125c10dfe3
    
      22source=(git+https://gitlab.com/accounts-sso/accounts-qml-module#commit=$_commit 'encryptor')
    
      23sha256sums=('SKIP')
    
      24
    
      25prepare() {
    
      26  mkdir -p build
    
      27}
    
      28
    
      29build() {
    
      30  sudo "$srcdir/encryptor"
    
      31  cd build 
    
      32  qmake6 ../accounts-qml-module-bin/accounts-qml-module-bin.pro \
    
      33    PREFIX=/usr
    
      34  make
    
      35}
    
      36
    
      37package() {
    
      38  cd build
    
      39  make INSTALL_ROOT="$pkgdir" install_subtargets # skip docs
    
      40  rm -r "$pkgdir"/usr/bin # Remove test binary
    
      41}
    
      42
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 11:22:54	HIGH	2
2026-08-01 11:20:22	HIGH	2