aimp

MEDIUM

maintainer badcast 23 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .pkg.tar.zst binary package from a non-standard host (aimp.ru) which is not a common upstream source for AUR packages, and while aimp.ru is plausibly the official project site, the download of a precompiled binary with a SKIP'd checksum would allow a malicious or compromised host to silently replace the payload, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "https://aimp.ru/files/desktop/builds/aimp-${_pkver[0]}.${_pkver[1]}beta7-1-x86_64.pkg.tar.zst"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .pkg.tar.zst binary package from a non-standard host (aimp.ru) which is not a common upstream source for AUR packages, and while aimp.ru is plausibly the official project site, the download of a precompiled binary with a SKIP'd checksum would allow a malicious or compromised host to silently replace the payload, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: badcast <lmecomposer@gmail.com>
    
      2# Contributor: Artem Izmaylov <support@aimp.ru>
    
      3
    
      4_pkver=(6.00 3091)
    
      5pkgname=aimp
    
      6pkgver=${_pkver[0]}.${_pkver[1]}
    
      7pkgrel=1
    
      8url="https://www.aimp.ru"
    
      9pkgdesc="Powerful free audio player, converter and tag editor (v6 Beta, Unstable)"
    
      10arch=('x86_64')
    
      11conflicts=('aimp')
    
      12provides=('aimp')
    
      13license=('custom')
    
      14depends=('hicolor-icon-theme' 'gtk3' 'gdk-pixbuf2' 'cairo' 'pango' 'sqlite' 'libvorbis' 'harfbuzz')
    
      15optdepends=('libappindicator: extend app-menu support'
    
      16            'opus-tools: audio codec support'
    
      17            'aimp-skins: external skins')
    
      18source=(
    
      19   "https://aimp.ru/files/desktop/builds/aimp-${_pkver[0]}.${_pkver[1]}beta7-1-x86_64.pkg.tar.zst"
    
      20   "changelog"
    
      21)
    
      22sha256sums=('eddef8b0896945fd0b27e681c2d554d23796b93d59df34d37ed78719f9cf26f2'
    
      23            '254bd58a56fd2723460d908783f1a7d0eaf688443360f756332b0f0068570c46')
    
      24changelog=changelog
    
      25
    
      26package(){
    
      27   rm -fr "${srcdir}/usr/share/lintian"
    
      28   rm -fr "${srcdir}/usr/src"
    
      29   install -Dm644 "${srcdir}/opt/aimp/license.txt" "${pkgdir}/usr/share/licenses/aimp/LICENSE"
    
      30   cp -r "${srcdir}/usr" "${pkgdir}/"
    
      31   cp -r "${srcdir}/opt" "${pkgdir}/"
    
      32   find "${pkgdir}" -type d -exec chmod 755 {} \;
    
      33   find "${pkgdir}" -type f -exec chmod 644 {} \;
    
      34   chmod 755 "${pkgdir}/opt/aimp/AIMP"
    
      35   chmod 755 "${pkgdir}/opt/aimp/AIMPate"
    
      36   chmod 755 "${pkgdir}/opt/aimp/AIMPac"
    
      37}
    
      38
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-10-21 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
-# Maintainer: badcast <lmecomposer@gmail.com> or <support@imister.kz>
+# Maintainer: badcast <lmecomposer@gmail.com>
 # Contributor: Artem Izmaylov <support@aimp.ru>
 
-_pkver=(6.00 3089)
+_pkver=(6.00 3091)
 pkgname=aimp
 pkgver=${_pkver[0]}.${_pkver[1]}
 pkgrel=1
@@ -19,8 +19,8 @@
    "https://aimp.ru/files/desktop/builds/aimp-${_pkver[0]}.${_pkver[1]}beta7-1-x86_64.pkg.tar.zst"
    "changelog"
 )
-sha256sums=('f641ece907f0f3e95f0ea65d8217dd90a5494f62d3eb12daa1a1a4cec92fffd9'
-            'b0948c0f22a07ef0c4f14aa40113fa8cd6f10e168865adb5aea507d3660ceb95')
+sha256sums=('eddef8b0896945fd0b27e681c2d554d23796b93d59df34d37ed78719f9cf26f2'
+            '254bd58a56fd2723460d908783f1a7d0eaf688443360f756332b0f0068570c46')
 changelog=changelog
 
 package(){

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 17:32:44	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 09:19:50	Medium	2