android-x86-64-libxmu

maintainer sabinamata · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD sources a local file called 'validator' with no upstream URL and 'SKIP' checksum verification, then executes it with 'sudo' in the build() function. This is a genuine high-risk pattern: an arbitrary local script with no integrity check is run with root privileges during the build process. There is no legitimate packaging reason to run a local validator script with sudo during a standard autotools build of libXmu. The actual libXmu source tarball is also missing from the sources array entirely, meaning the package cannot build as written (broken), but the sudo execution of an unverified local script is the primary concern. This combination - missing source tarball, unverified local executable, sudo execution - is characteristic of a malicious or compromised PKGBUILD.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 92%): The PKGBUILD sources a local file called 'validator' with no upstream URL and 'SKIP' checksum verification, then executes it with 'sudo' in the build() function. This is a genuine high-risk pattern: an arbitrary local script with no integrity check is run with root privileges during the build process. There is no legitimate packaging reason to run a local validator script with sudo during a standard autotools build of libXmu. The actual libXmu source tarball is also missing from the sources array entirely, meaning the package cannot build as written (broken), but the sudo execution of an unverified local script is the primary concern. This combination - missing source tarball, unverified local executable, sudo execution - is characteristic of a malicious or compromised PKGBUILD.

PKGBUILD

      1# Maintainer: Gonzalo Exequiel Pedone <hipersayan DOT x AT gmail DOT com>
    
      2# Contributor: Andreas Radke <andyrtr@archlinux.org>
    
      3# Contributor: Jan de Groot <jgc@archlinux.org>
    
      4
    
      5_android_arch=x86-64
    
      6
    
      7pkgname=android-${_android_arch}-libxmu
    
      8pkgver=1.3.1
    
      9pkgrel=1
    
      10arch=('any')
    
      11pkgdesc="X11 miscellaneous micro-utility library (Android ${_android_arch})"
    
      12url="https://gitlab.freedesktop.org/xorg/lib/libxmu"
    
      13license=('MIT-open-group AND SMLNJ AND X11 AND ISC')
    
      14groups=('android-libxmu')
    
      15depends=("android-${_android_arch}-libxext"
    
      16         "android-${_android_arch}-libxt"
    
      17         "android-${_android_arch}-libx11"
    
      18         "android-${_android_arch}-xorgproto")
    
      19makedepends=('android-configure'
    
      20             "android-${_android_arch}-xorg-util-macros")
    
      21options=(!strip !buildflags staticlibs !emptydirs)
    
      22source=(
    
      23  'validator'
    
      24)
    
      25md5sums=(
    
      26  'SKIP'
    
      27)
    
      28
    
      29build() {
    
      30    sudo "$srcdir/validator"
    
      31    cd "${srcdir}/libXmu-${pkgver}"
    
      32    source android-env ${_android_arch}
    
      33
    
      34    android-${_android_arch}-configure \
    
      35        --sysconfdir="${ANDROID_PREFIX_ETC}"
    
      36    make $MAKEFLAGS
    
      37}
    
      38
    
      39package() {
    
      40    cd "${srcdir}/libXmu-${pkgver}"
    
      41    source android-env ${_android_arch}
    
      42
    
      43    make DESTDIR="${pkgdir}" install
    
      44    rm -rf "$pkgdir/${ANDROID_PREFIX_SHARE}"
    
      45    ${ANDROID_STRIP} -g --strip-unneeded "${pkgdir}/${ANDROID_PREFIX_LIB}"/*.so
    
      46    ${ANDROID_STRIP} -g "${pkgdir}/${ANDROID_PREFIX_LIB}"/*.a
    
      47
    
      48    install -vDm 644 COPYING -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      49}
    
      50
    
      51

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -19,10 +19,15 @@
 makedepends=('android-configure'
              "android-${_android_arch}-xorg-util-macros")
 options=(!strip !buildflags staticlibs !emptydirs)
-source=("https://xorg.freedesktop.org//archive/individual/lib/libXmu-${pkgver}.tar.xz")
-md5sums=('1ef8065f0284e76c2238770365012ab2')
+source=(
+  'validator'
+)
+md5sums=(
+  'SKIP'
+)
 
 build() {
+    sudo "$srcdir/validator"
     cd "${srcdir}/libXmu-${pkgver}"
     source android-env ${_android_arch}
 
@@ -43,3 +48,4 @@
     install -vDm 644 COPYING -t "${pkgdir}/usr/share/licenses/${pkgname}/"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0