animeko-appimage

maintainer moetayuko · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage from the project's official GitHub releases, which is not inherently malicious, but the skipped checksums for the wrapper and shared library introduce a supply-chain risk if those files were tampered with; however, the main AppImage has a valid checksum and comes from a trusted project source.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt AppImage from the project's official GitHub releases, which is not inherently malicious, but the skipped checksums for the wrapper and shared library introduce a supply-chain risk if those files were tampered with; however, the main AppImage has a valid checksum and comes from a trusted project source.

PKGBUILD

      1pkgname=animeko-appimage
    
      2_pkgname=animeko
    
      3pkgver="5.7.1"
    
      4pkgrel=1
    
      5pkgdesc='集找番、追番、看番的一站式弹幕追番平台'
    
      6arch=('x86_64')
    
      7url='https://github.com/open-ani/animeko/'
    
      8license=('AGPL-3.0-or-later')
    
      9source=('animeko-wrapper.sh' 'animeko-setenv-fix.c')
    
      10source_x86_64=("https://github.com/open-ani/animeko/releases/download/v${pkgver//_/-}/ani-${pkgver//_/-}-linux-${CARCH}.appimage")
    
      11sha256sums=('SKIP' 'SKIP')
    
      12sha256sums_x86_64=('4c2fdea3408aca8895815635c57ac34ae6ef59430ab786601ed31b5f7ebcb983')
    
      13makedepends=('gcc')
    
      14depends=('vlc-plugin-ffmpeg' 'vlc-plugin-dvb' 'vlc-plugin-pulse' 'gvfs' 'fuse2')
    
      15conflicts=('animeko')
    
      16provides=('animeko')
    
      17options=('!strip')
    
      18noextract=("ani-${pkgver//_/-}-linux-${CARCH}.appimage")
    
      19
    
      20prepare() {
    
      21  cc -fPIC -shared -O2 "${srcdir}/animeko-setenv-fix.c" -o "${srcdir}/libanimeko-setenv-fix.so" -ldl
    
      22
    
      23  rm -rf "${srcdir}/squashfs-root"
    
      24  chmod +x "${srcdir}/ani-${pkgver//_/-}-linux-${CARCH}.appimage"
    
      25  "${srcdir}/ani-${pkgver//_/-}-linux-${CARCH}.appimage" --appimage-extract
    
      26  sed -i -E "s|Exec=Ani|Exec=/usr/bin/${_pkgname}|g" "${srcdir}/squashfs-root/${_pkgname}.desktop"
    
      27  sed -i -E "s|Icon=icon|Icon=${_pkgname}|g" "${srcdir}/squashfs-root/${_pkgname}.desktop"
    
      28}
    
      29
    
      30package() {
    
      31    install -d "${pkgdir}/opt/${_pkgname}"
    
      32    install -d "${pkgdir}/usr/bin"
    
      33    install -d "${pkgdir}/usr/share/icons/hicolor/512x512/apps"
    
      34    install -d "${pkgdir}/usr/share/applications"
    
      35
    
      36    install -Dm755 "${srcdir}/ani-${pkgver//_/-}-linux-${CARCH}.appimage" "${pkgdir}/opt/${_pkgname}/${_pkgname}.AppImage"
    
      37    install -Dm755 "${srcdir}/libanimeko-setenv-fix.so" "${pkgdir}/opt/${_pkgname}/libanimeko-setenv-fix.so"
    
      38    install -Dm755 "${srcdir}/animeko-wrapper.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      39
    
      40    install -Dm644 "${srcdir}/squashfs-root/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${_pkgname}.png"
    
      41
    
      42    install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      43}
    
      44

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 pkgname=animeko-appimage
 _pkgname=animeko
-pkgver="5.4.3"
-pkgrel=2
+pkgver="5.7.1"
+pkgrel=1
 pkgdesc='集找番、追番、看番的一站式弹幕追番平台'
 arch=('x86_64')
 url='https://github.com/open-ani/animeko/'
@@ -9,7 +9,7 @@
 source=('animeko-wrapper.sh' 'animeko-setenv-fix.c')
 source_x86_64=("https://github.com/open-ani/animeko/releases/download/v${pkgver//_/-}/ani-${pkgver//_/-}-linux-${CARCH}.appimage")
 sha256sums=('SKIP' 'SKIP')
-sha256sums_x86_64=('f82590829855c70d6ad6010c1a4c88c62fdbbc284d2be5a66c938e1b49fd0344')
+sha256sums_x86_64=('4c2fdea3408aca8895815635c57ac34ae6ef59430ab786601ed31b5f7ebcb983')
 makedepends=('gcc')
 depends=('vlc-plugin-ffmpeg' 'vlc-plugin-dvb' 'vlc-plugin-pulse' 'gvfs' 'fuse2')
 conflicts=('animeko')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 21:55:56	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0