andromeda-js-bin

LOW

maintainer starccy 1 votes scanned 2026-08-20 11:11:30.284264

View on AUR

Why flagged

The package downloads a prebuilt binary from the project's official GitHub release page, which is a normal distribution method; the binary is used to generate shell completions during packaging, a legitimate use, and the source is verifiable via checksum, so despite few votes and recent upload, there is no evidence of malicious intent or supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from the project's official GitHub release page, which is a normal distribution method; the binary is used to generate shell completions during packaging, a legitimate use, and the source is verifiable via checksum, so despite few votes and recent upload, there is no evidence of malicious intent or supply-chain risk.

PKGBUILD

      1# Maintainer: starccy <starccyz@gmail.com>
    
      2
    
      3pkgname=andromeda-js-bin
    
      4_binname=andromeda
    
      5pkgver=0.1.14
    
      6pkgrel=1
    
      7pkgdesc='JS/TS runtime in Rust powered by Nova, with no transpilation needed'
    
      8arch=('x86_64')
    
      9url='https://github.com/tryandromeda/andromeda'
    
      10license=('MPL-2.0')
    
      11depends=('glibc' 'libgcc')
    
      12provides=("$_binname=$pkgver")
    
      13conflicts=("$_binname")
    
      14options=('!debug')
    
      15install="$pkgname.install"
    
      16source=("$_binname-$pkgver::$url/releases/download/$pkgver/andromeda-linux-amd64"
    
      17        "LICENSE.md-$pkgver::https://raw.githubusercontent.com/tryandromeda/andromeda/$pkgver/LICENSE.md")
    
      18noextract=("$_binname-$pkgver")
    
      19sha256sums=('96d415ab54330b9479b537a1825b9be4f4e3d2966352fe56096d9a4a2666b912'
    
      20            '2d52c2001a5d9ebc06802c9e5d8d8bd70ca8c57daf6a6c63e66156326597ac7a')
    
      21
    
      22package() {
    
      23	install -Dm755 "$srcdir/$_binname-$pkgver" "$pkgdir/usr/bin/$_binname"
    
      24	install -Dm644 "$srcdir/LICENSE.md-$pkgver" \
    
      25		"$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
    
      26
    
      27	local _bin="$pkgdir/usr/bin/$_binname"
    
      28	"$_bin" completions bash |
    
      29		install -Dm644 /dev/stdin "$pkgdir/usr/share/bash-completion/completions/$_binname"
    
      30	"$_bin" completions zsh |
    
      31		install -Dm644 /dev/stdin "$pkgdir/usr/share/zsh/site-functions/_$_binname"
    
      32	"$_bin" completions fish |
    
      33		install -Dm644 /dev/stdin "$pkgdir/usr/share/fish/vendor_completions.d/$_binname.fish"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 11:11:30	Low	2