animaru (MEDIUM) - AURWatch

Triggered rules

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:31 pipx install "git+https://github.com/murdialthaf/animaru.git"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package installs unverified Python code via pipx from a git repository at runtime, creating a supply-chain risk if the repository is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Murdi <murdialthaf848@gmail.com>
    
      2
    
      3pkgname=animaru
    
      4pkgver=0.2.0
    
      5pkgrel=1
    
      6pkgdesc="A GTK4 GUI for watching and downloading anime"
    
      7arch=('any')
    
      8url="https://github.com/murdialthaf/animaru"
    
      9license=('GPL3')
    
      10depends=(
    
      11  'python'
    
      12  'python-gobject'
    
      13  'python-pipx'
    
      14  'gtk4'
    
      15  'libadwaita'
    
      16  'mpv'
    
      17)
    
      18
    
      19source=("${pkgname}-${pkgver}.tar.gz::https://github.com/murdialthaf/${pkgname}/archive/v${pkgver}.tar.gz")
    
      20sha256sums=('SKIP')
    
      21
    
      22package() {
    
      23  cd "${srcdir}/${pkgname}-${pkgver}"
    
      24
    
      25  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/animaru" << 'WRAPPER'
    
      26#!/bin/bash
    
      27APP=animaru
    
      28PIPX_HOME="${XDG_DATA_HOME:-$HOME/.local/share}/pipx"
    
      29export PIPX_HOME
    
      30if ! "$PIPX_HOME/venvs/$APP/bin/$APP" --version &>/dev/null; then
    
      31  pipx install "git+https://github.com/murdialthaf/animaru.git"
    
      32fi
    
      33exec "$PIPX_HOME/venvs/$APP/bin/$APP" "$@"
    
      34WRAPPER
    
      35
    
      36  install -Dm644 data/animaru.desktop -t "${pkgdir}/usr/share/applications"
    
      37  install -Dm644 data/icons/animaru.svg -t "${pkgdir}/usr/share/icons/hicolor/scalable/apps"
    
      38}
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-07-24 00:02
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Murdi <murdialthaf848@gmail.com>
 
 pkgname=animaru
-pkgver=0.1.1
+pkgver=0.2.0
 pkgrel=1
 pkgdesc="A GTK4 GUI for watching and downloading anime"
 arch=('any')
@@ -10,44 +10,28 @@
 depends=(
   'python'
   'python-gobject'
+  'python-pipx'
   'gtk4'
   'libadwaita'
   'mpv'
-  'python-beautifulsoup4'
-  'python-dataclasses-json'
-  'python-levenshtein'
-  'python-pycountry'
-  'python-pycryptodomex'
-  'python-rapidfuzz'
-  'python-requests'
-  'python-urllib3'
-  'python-mpv'
-  'python-pyee'
-  'python-typing_extensions'
-)
-makedepends=(
-  'python-build'
-  'python-installer'
-  'python-wheel'
-  'python-setuptools'
-  'python-pip'
 )
 
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/murdialthaf/${pkgname}/archive/v${pkgver}.tar.gz")
 sha256sums=('SKIP')
 
-build() {
-  cd "${srcdir}/${pkgname}-${pkgver}"
-  python -m build --wheel --no-isolation
-}
-
 package() {
   cd "${srcdir}/${pkgname}-${pkgver}"
 
-  python -m installer --destdir="${pkgdir}" dist/*.whl
-
-  # Bundle anipy-api and its dependencies not available in Arch repos
-  pip install --root="${pkgdir}" --prefix=/usr --no-deps anipy-api m3u8 python-ffmpeg simpleeval
+  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/animaru" << 'WRAPPER'
+#!/bin/bash
+APP=animaru
+PIPX_HOME="${XDG_DATA_HOME:-$HOME/.local/share}/pipx"
+export PIPX_HOME
+if ! "$PIPX_HOME/venvs/$APP/bin/$APP" --version &>/dev/null; then
+  pipx install "git+https://github.com/murdialthaf/animaru.git"
+fi
+exec "$PIPX_HOME/venvs/$APP/bin/$APP" "$@"
+WRAPPER
 
   install -Dm644 data/animaru.desktop -t "${pkgdir}/usr/share/applications"
   install -Dm644 data/icons/animaru.svg -t "${pkgdir}/usr/share/icons/hicolor/scalable/apps"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 15:27:57	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 13:24:23	MEDIUM	3
2026-07-23 11:25:03	MEDIUM	3
2026-07-23 11:23:42	MEDIUM	3
2026-07-23 09:24:46	MEDIUM	3
2026-07-23 09:22:54	MEDIUM	3