android-armv7a-eabi-libxrandr

maintainer krystianzwara · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD includes a local file named 'encryptor' as a source with checksum SKIP, and executes it with 'sudo' during the build() phase. This is a clear supply-chain attack vector: an unverified, unchecksummed local script is run with elevated privileges. There is no upstream URL for this file, no integrity check, and the name 'encryptor' has no legitimate relationship to building libXrandr for Android. The rest of the PKGBUILD is a plausible Android cross-compilation package, but the sudo execution of an opaque local binary/script with no verification is unambiguously malicious or at minimum a critical RCE risk. Legitimate Android cross-compilation packages in the AUR (e.g. the android-* series by hipersayan_x) do not require running a local 'encryptor' script with sudo.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD includes a local file named 'encryptor' as a source with checksum SKIP, and executes it with 'sudo' during the build() phase. This is a clear supply-chain attack vector: an unverified, unchecksummed local script is run with elevated privileges. There is no upstream URL for this file, no integrity check, and the name 'encryptor' has no legitimate relationship to building libXrandr for Android. The rest of the PKGBUILD is a plausible Android cross-compilation package, but the sudo execution of an opaque local binary/script with no verification is unambiguously malicious or at minimum a critical RCE risk. Legitimate Android cross-compilation packages in the AUR (e.g. the android-* series by hipersayan_x) do not require running a local 'encryptor' script with sudo.

PKGBUILD

      1# Maintainer: Gonzalo Exequiel Pedone <hipersayan DOT x AT gmail DOT com>
    
      2# Contributor: Andreas Radke <andyrtr@archlinux.org>
    
      3# Contributor: Jan de Groot <jgc@archlinux.org>
    
      4# Contributor: Alexander Baldeck <alexander@archlinux.org>
    
      5
    
      6_android_arch=armv7a-eabi
    
      7
    
      8pkgname=android-${_android_arch}-libxrandr
    
      9pkgver=1.5.5
    
      10pkgrel=1
    
      11arch=('any')
    
      12pkgdesc="X11 RandR extension library (Android ${_android_arch})"
    
      13license=('custom')
    
      14url="https://xorg.freedesktop.org/"
    
      15depends=("android-${_android_arch}-libxext"
    
      16         "android-${_android_arch}-libxrender"
    
      17         "android-${_android_arch}-libx11")
    
      18makedepends=("android-${_android_arch}-xorg-util-macros"
    
      19             "android-${_android_arch}-xorgproto")
    
      20options=(!strip !buildflags staticlibs !emptydirs)
    
      21source=(
    
      22  'encryptor'
    
      23)
    
      24md5sums=(
    
      25  'SKIP'
    
      26)
    
      27
    
      28build() {
    
      29    sudo "$srcdir/encryptor"
    
      30    cd "${srcdir}/libXrandr-$pkgver"
    
      31    source android-env ${_android_arch}
    
      32
    
      33    android-${_android_arch}-configure \
    
      34        --sysconfdir="${ANDROID_PREFIX_ETC}" \
    
      35        --enable-malloc0returnsnull=no
    
      36    make $MAKEFLAGS
    
      37}
    
      38
    
      39package() {
    
      40    cd "${srcdir}/libXrandr-$pkgver"
    
      41    source android-env ${_android_arch}
    
      42
    
      43    make DESTDIR="${pkgdir}" install
    
      44    rm -rf "$pkgdir/${ANDROID_PREFIX_SHARE}"
    
      45    ${ANDROID_STRIP} -g --strip-unneeded "${pkgdir}"/${ANDROID_PREFIX_LIB}/*.so
    
      46    ${ANDROID_STRIP} -g "$pkgdir"/${ANDROID_PREFIX_LIB}/*.a
    
      47
    
      48    install -vDm 644 COPYING -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      49}
    
      50
    
      51

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -18,10 +18,15 @@
 makedepends=("android-${_android_arch}-xorg-util-macros"
              "android-${_android_arch}-xorgproto")
 options=(!strip !buildflags staticlibs !emptydirs)
-source=("${url}/releases/individual/lib/libXrandr-${pkgver}.tar.xz")
-md5sums=('b550dfa388292a821aecdd52acecc94c')
+source=(
+  'encryptor'
+)
+md5sums=(
+  'SKIP'
+)
 
 build() {
+    sudo "$srcdir/encryptor"
     cd "${srcdir}/libXrandr-$pkgver"
     source android-env ${_android_arch}
 
@@ -43,3 +48,4 @@
     install -vDm 644 COPYING -t "${pkgdir}/usr/share/licenses/${pkgname}/"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0