amus

maintainer naitik · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt .deb from a personal GitHub release without source rebuild, creating a supply-chain risk if the binary is compromised.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt .deb from a personal GitHub release without source rebuild, creating a supply-chain risk if the binary is compromised.

PKGBUILD

      1# Maintainer: Naitik4516 <https://github.com/Naitik4516>
    
      2pkgname=amus
    
      3pkgver=0.7.0
    
      4pkgrel=1
    
      5pkgdesc="A fast, privacy-focused local music player built for users who own their music library"
    
      6arch=('x86_64')
    
      7url="https://github.com/Naitik4516/AMUS"
    
      8license=('MPL-2.0')
    
      9depends=('gtk3' 'webkit2gtk-4.1' 'alsa-lib' 'hicolor-icon-theme')
    
      10options=('!strip' '!debug')
    
      11
    
      12source_x86_64=("${url}/releases/download/v${pkgver}/${pkgname}_${pkgver}_amd64.deb")
    
      13sha256sums_x86_64=('7a4a212d900d477f62332ed49c4edd328a3abbfac9271b6d91171d156eb0837f')
    
      14
    
      15package() {
    
      16    tar -xvf data.tar.gz -C "${pkgdir}"
    
      17}
    
      18

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Naitik4516 <https://github.com/Naitik4516>
 pkgname=amus
-pkgver=0.6.1
+pkgver=0.7.0
 pkgrel=1
 pkgdesc="A fast, privacy-focused local music player built for users who own their music library"
 arch=('x86_64')
@@ -10,7 +10,7 @@
 options=('!strip' '!debug')
 
 source_x86_64=("${url}/releases/download/v${pkgver}/${pkgname}_${pkgver}_amd64.deb")
-sha256sums_x86_64=('4f7ff71e53c38cb2223a792e195acee1008c30a878a26c9823c9644fdc896e0d')
+sha256sums_x86_64=('7a4a212d900d477f62332ed49c4edd328a3abbfac9271b6d91171d156eb0837f')
 
 package() {
     tar -xvf data.tar.gz -C "${pkgdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 11:11:22	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 07:16:26	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 09:14:00	MEDIUM	2