ampinstmgr

LOW

maintainer Wrxn 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The source is a prebuilt tarball from the vendor's own domain (cubecoders.com), which hosts the official AMP software; while not on a standard code forge, it is the legitimate distribution point, and the package installs only the vendor's files without executing remote code or exhibiting malicious behavior.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt tarball from the vendor's own domain (cubecoders.com), which hosts the official AMP software; while not on a standard code forge, it is the legitimate distribution point, and the package installs only the vendor's files without executing remote code or exhibiting malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("http://repo.cubecoders.com/$pkgname-$pkgver.x86_64.tgz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Wrxn <arch@rnny.xyz>
    
      2pkgname=ampinstmgr
    
      3pkgver=2.8.0.4
    
      4pkgrel=1
    
      5epoch=
    
      6pkgdesc="AMP (Application Management Panel) is a simple to use and easy to install control panel and management system for hosting game servers."
    
      7arch=('i686' 'x86_64')
    
      8url="https://cubecoders.com/AMP"
    
      9license=(unknown)
    
      10groups=()
    
      11depends=(tmux socat dnsutils jq qrencode mono)
    
      12makedepends=()
    
      13checkdepends=()
    
      14optdepends=(jre8-openjdk-headless jre-openjdk-headless steamcmd docker)
    
      15provides=()
    
      16conflicts=()
    
      17replaces=()
    
      18backup=()
    
      19options=(!strip)
    
      20install=
    
      21changelog=
    
      22source=("http://repo.cubecoders.com/$pkgname-$pkgver.x86_64.tgz"
    
      23        sysusers.conf
    
      24        tmpfiles.conf
    
      25       )
    
      26sha256sums=('245a923b28a0deafe8e58fb42bb5ac4b43045a7543dd23f56ae03ddaa358c29a'
    
      27            '54478340926d4f49dd784c7cffe8e191a0b5b1dc29b72694f02b40a9672d9237'
    
      28            '5c6a673550c8243556e2c770c8e85f5892cdee334d063e49aa398175b00fce11')
    
      29noextract=()
    
      30
    
      31package() {
    
      32  cd "$srcdir/"
    
      33
    
      34  cp -r . "$pkgdir/"
    
      35
    
      36  rm "$pkgdir/$pkgname-$pkgver.x86_64.tgz"
    
      37
    
      38  # move system units to the correct place
    
      39  install -dm755 "$pkgdir/usr/lib"
    
      40  mv "$pkgdir/etc/systemd" "$pkgdir/usr/lib"
    
      41
    
      42  # add amp user
    
      43  install -Dm644 sysusers.conf "$pkgdir/usr/lib/sysusers.d/ampinstmgr.conf"
    
      44  install -Dm644 tmpfiles.conf "$pkgdir/usr/lib/tmpfiles.d/ampinstmgr.conf"
    
      45}
    
      46
    
      47# vim:set ts=2 sw=2 et:
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2