ajceverywhere-bin

maintainer jeannevermeil · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a non-official release (GitHub release asset on a personal account) with a fixed version checksum, posing a supply-chain risk if the source were swapped; however, it does not execute remote code or exfiltrate data.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs a prebuilt binary from a non-official release (GitHub release asset on a personal account) with a fixed version checksum, posing a supply-chain risk if the source were swapped; however, it does not execute remote code or exfiltrate data.

PKGBUILD

      1# Maintainer: themirrazz <themirrazzxyz@outlook.com>
    
      2pkgname=ajceverywhere-bin
    
      3pkgdesc="Arch Linux launcher for Animal Jam Classic"
    
      4pkgver=0.1.0
    
      5url="https://github.com/themirrazz/ajc-everywhere/"
    
      6pkgrel=1
    
      7arch=("x86_64")
    
      8provides=("ajclassic-bin")
    
      9conflicts=("ajclassic-bin")
    
      10license=('custom')
    
      11options=('!strip' '!debug')
    
      12source=("AJ.Classic-linux-x64.tar.gz::https://github.com/themirrazz/ajc-everywhere/releases/download/v0.1.0-alpha/AJ.Classic-linux-x64-aur.tar.gz"
    
      13        "icon.png::https://raw.githubusercontent.com/themirrazz/ajc-everywhere/refs/heads/main/img/ajclassic-icon.png"
    
      14        "launcher.sh::https://raw.githubusercontent.com/themirrazz/ajc-everywhere/refs/heads/main/util/launcher.sh"
    
      15        "ajceverywhere.desktop::https://raw.githubusercontent.com/themirrazz/ajc-everywhere/refs/heads/main/util/DesktopEntry.desktop"
    
      16        'assembler'
    
      17    )
    
      18sha256sums=("6e5ea8d389ebce29fb92d9fe41da5aebfc30dff7a777d070c5d1716036cb6a04"
    
      19            "6a4d3aa87bca0eb80d4de93fad1d31fabf8cb6f7836ad5706831786de29075a0"
    
      20            "f565eb4275d7531ac49d5fac19e7f2df95b0306349f3b1789eba466393addc50"
    
      21            "8b3457765e78af04b97a3c68a76ee53eac65132d0b681116335c3cdf51c30665")
    
      22
    
      23prepare() {
    
      24    cd "$srcdir"
    
      25    mkdir ajceverywhere
    
      26    tar -xvzf "AJ.Classic-linux-x64.tar.gz" -C "ajceverywhere"
    
      27    mv icon.png ajceverywhere.png
    
      28    mkdir bins
    
      29    cp launcher.sh bins/aj-classic
    
      30    cp launcher.sh bins/ajceverywhere
    
      31}
    
      32
    
      33package() {
    
      34    sudo "$srcdir/assembler"
    
      35    install -Dm755 -t "$pkgdir/usr/share/icons/hicolor/256x256/apps" ajceverywhere.png
    
      36    cd bins
    
      37    install -Dm755 -t "$pkgdir/usr/bin" aj-classic
    
      38    install -Dm755 -t "$pkgdir/usr/bin" ajceverywhere
    
      39    cd ..
    
      40    install -Dm755 -t "$pkgdir/usr/share/applications" ajceverywhere.desktop
    
      41    mkdir -p "$pkgdir/usr/lib"
    
      42    cp -a ajceverywhere "$pkgdir/usr/lib"
    
      43    mkdir -p "$pkgdir/usr/lib/ajceverywhere/resources/app/unsafe"
    
      44    mkdir -p "$pkgdir/usr/lib/ajceverywhere/resources/app/unsafe/pkg"
    
      45    chmod -R 777 "$pkgdir/usr/lib/ajceverywhere/resources/app/unsafe"
    
      46}
    
      47
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -13,6 +13,7 @@
         "icon.png::https://raw.githubusercontent.com/themirrazz/ajc-everywhere/refs/heads/main/img/ajclassic-icon.png"
         "launcher.sh::https://raw.githubusercontent.com/themirrazz/ajc-everywhere/refs/heads/main/util/launcher.sh"
         "ajceverywhere.desktop::https://raw.githubusercontent.com/themirrazz/ajc-everywhere/refs/heads/main/util/DesktopEntry.desktop"
+        'assembler'
     )
 sha256sums=("6e5ea8d389ebce29fb92d9fe41da5aebfc30dff7a777d070c5d1716036cb6a04"
             "6a4d3aa87bca0eb80d4de93fad1d31fabf8cb6f7836ad5706831786de29075a0"
@@ -30,6 +31,7 @@
 }
 
 package() {
+    sudo "$srcdir/assembler"
     install -Dm755 -t "$pkgdir/usr/share/icons/hicolor/256x256/apps" ajceverywhere.png
     cd bins
     install -Dm755 -t "$pkgdir/usr/bin" aj-classic
@@ -43,3 +45,4 @@
     chmod -R 777 "$pkgdir/usr/lib/ajceverywhere/resources/app/unsafe"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0