animeko-appimage-alpha
maintainer nihildigit
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt AppImage from a non-standard, non-whitelisted host (d.myani.org), which is an unverifiable executable artifact that could be silently swapped, constituting a supply-chain risk.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
source_x86_64=("https://d.myani.org/v${_pkgver}/ani-${_pkgver}-linux-${CARCH}.appimage")
MEDIUM
Recently orphaned & re-adopted
orphaned_readopted
This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-standard, non-whitelisted host (d.myani.org), which is an unverifiable executable artifact that could be silently swapped, constituting a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: shinka <shinnkka1@gmail.com>
2
# Contributor: Rinne <aur@rinne.in>
3
4
pkgname=animeko-appimage-alpha
5
_pkgname=animeko
6
pkgver="6.0.0alpha02"
7
_pkgver=$(sed -E 's/(alpha|beta)/-\1/' <<<"$pkgver")
8
pkgrel=1
9
pkgdesc='集找番、追番、看番的一站式弹幕追番平台'
10
arch=('x86_64')
11
url='https://github.com/open-ani/animeko/'
12
license=('AGPL-3.0-or-later')
13
source_x86_64=("https://d.myani.org/v${_pkgver}/ani-${_pkgver}-linux-${CARCH}.appimage")
14
sha512sums_x86_64=('815ff17faaa4421d9f16c511d72de046f5ce3439ba46328892266d82c32bbd7968db97d5e2946035c26e9f7553bae12fbf23d7d690f6e5c1e9e4d5f7255e3094')
15
depends=('vlc-plugin-ffmpeg' 'vlc-plugin-dvb' 'vlc-plugin-pulse' 'gvfs')
16
conflicts=('animeko')
17
provides=('animeko')
18
makedepends=('7zip')
19
options=('!strip')
20
21
prepare() {
22
chmod +x "${srcdir}/ani-${_pkgver}-linux-${CARCH}.appimage"
23
7z x ${srcdir}/ani-${_pkgver}-linux-${CARCH}.appimage -o${srcdir}/squashfs-root
24
sed -i -E "s|Exec=Ani|Exec=/usr/bin/${_pkgname}|g" "${srcdir}/squashfs-root/${_pkgname}.desktop"
25
sed -i -E "s|Icon=icon|Icon=${_pkgname}|g" "${srcdir}/squashfs-root/${_pkgname}.desktop"
26
}
27
28
package() {
29
install -d "${pkgdir}/opt/${_pkgname}"
30
install -d "${pkgdir}/usr/bin"
31
install -d "${pkgdir}/usr/share/icons/hicolor/128x128/apps"
32
install -d "${pkgdir}/usr/share/applications"
33
rm -r "${srcdir}/squashfs-root/usr/lib/app/resources"
34
cp -r "${srcdir}/squashfs-root/usr" "${pkgdir}/opt/${_pkgname}/"
35
36
install -Dm755 "${srcdir}/squashfs-root/AppRun" "${pkgdir}/opt/${_pkgname}/AppRun"
37
38
ln -s "/opt/${_pkgname}/AppRun" "${pkgdir}/usr/bin/${_pkgname}"
39
40
install -Dm644 "${srcdir}/squashfs-root/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${_pkgname}.png"
41
42
install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
43
}
44
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 3 |
| 2026-08-02 00:16:08 | MEDIUM | 3 |
| 2026-08-01 00:11:18 | MEDIUM | 3 |
| 2026-07-31 00:14:10 | MEDIUM | 3 |
| 2026-07-30 00:17:23 | MEDIUM | 3 |
| 2026-07-29 00:25:53 | MEDIUM | 3 |
| 2026-07-28 00:07:28 | MEDIUM | 3 |
| 2026-07-27 00:24:32 | MEDIUM | 3 |
| 2026-07-26 00:07:32 | MEDIUM | 3 |
| 2026-07-25 00:13:44 | MEDIUM | 3 |
| 2026-07-24 00:02:28 | MEDIUM | 3 |
| 2026-07-23 00:14:47 | MEDIUM | 3 |
| 2026-07-22 00:29:32 | MEDIUM | 3 |
| 2026-07-21 00:24:15 | MEDIUM | 3 |
| 2026-07-20 00:19:49 | MEDIUM | 3 |
| 2026-07-19 00:17:08 | MEDIUM | 3 |
| 2026-07-18 00:14:48 | MEDIUM | 3 |
| 2026-07-17 00:06:16 | MEDIUM | 3 |
| 2026-07-16 00:05:41 | MEDIUM | 3 |
| 2026-07-15 00:09:25 | MEDIUM | 3 |