adbcontrol

maintainer vinibali · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt JAR file is downloaded from a personal/blog host (marian.schedenig.name) and executed directly via 'java -jar adbcontrol.jar'. JARs are executable code (JVM bytecode), not pure data, so this is a genuine supply-chain concern: if the host is compromised or the file is silently replaced, arbitrary code runs on the user's machine. The MD5 checksum provides only weak integrity assurance (MD5 is cryptographically broken). The host is not an official distribution channel (e.g. GitHub releases, Maven Central) but a personal WordPress blog. This matches the classic AUR medium-risk pattern of an executed binary from an unofficial personal host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(http://marian.schedenig.name/wp-content/uploads/adbcontrol.zip)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): A prebuilt JAR file is downloaded from a personal/blog host (marian.schedenig.name) and executed directly via 'java -jar adbcontrol.jar'. JARs are executable code (JVM bytecode), not pure data, so this is a genuine supply-chain concern: if the host is compromised or the file is silently replaced, arbitrary code runs on the user's machine. The MD5 checksum provides only weak integrity assurance (MD5 is cryptographically broken). The host is not an official distribution channel (e.g. GitHub releases, Maven Central) but a personal WordPress blog. This matches the classic AUR medium-risk pattern of an executed binary from an unofficial personal host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: vinibali <vinibali1 at gmail dot com>
    
      2
    
      3pkgname=adbcontrol
    
      4pkgver=0.1
    
      5pkgrel=3
    
      6pkgdesc="Remote control your Android phone through adb"
    
      7arch=(i686 x86_64)
    
      8url="http://marian.schedenig.name/2014/07/03/remote-control-your-android-phone-through-adb/"
    
      9license=('Eclipse Public Licence')
    
      10depends=(jre8-openjdk)
    
      11source=(http://marian.schedenig.name/wp-content/uploads/adbcontrol.zip)
    
      12md5sums=(a6fafab5525a8e02450b4456ea3ec141)
    
      13
    
      14build()
    
      15	{
    
      16	echo "###############################################"
    
      17	echo "No build requied, precompiled jar is avaliable,"
    
      18	echo "standard values has been placed in config file."
    
      19	echo "###############################################"
    
      20	}
    
      21
    
      22package()
    
      23	{
    
      24	mkdir -p "${pkgdir}"/opt/adbcontrol
    
      25	mkdir -p "${pkgdir}"/usr/bin
    
      26	echo -e 'adbCommand = /usr/bin/adb\nscreenshotDelay = 10\nlocalImageFilePath = /tmp/adbcontrol_screenshot.png\nphoneImageFilePath = /mnt/sdcard/adbcontrol_screenshot.png' > "${pkgdir}"/opt/adbcontrol/config.properties
    
      27	echo -e '#!/bin/bash\ncd /opt/adbcontrol\njava -jar adbcontrol.jar' > "${pkgdir}"/usr/bin/adbcontrol
    
      28	chmod +x "${pkgdir}"/usr/bin/adbcontrol
    
      29	cp -a "${srcdir}"/src "${pkgdir}"/opt/adbcontrol/
    
      30	install -Dm755 "${srcdir}"/adbcontrol.jar "${pkgdir}"/opt/adbcontrol/adbcontrol.jar
    
      31	install -Dm755 "${srcdir}"/epl-v10.html "${pkgdir}"/opt/adbcontrol/epl-v10.html
    
      32	}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2