arc-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("$pkgname-$pkgver.tar.gz::https://registry.eui.io/arc/${pkgver}/arc_${pkgver}_linux_amd64.tar.gz"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs a prebuilt binary ('arc') from registry.eui.io, which is the Electric UI project's own package registry (matching the maintainer's email domain @electricui.com and the official URL electricui.com). The host is not a well-known, independently audited distribution channel (like GitHub releases or an official distro mirror), but it does appear to be the vendor's own infrastructure. The binary is executed directly and installed to /usr/bin. The sha256 checksum provides integrity verification against tampering in transit, but does not protect against the upstream host serving a malicious binary. Since this is a prebuilt binary from a non-standard host (even if it is the vendor's own registry), it represents a genuine supply-chain concern: if registry.eui.io is compromised or the maintainer's control over it lapses, a malicious binary could be distributed. This is a textbook medium-severity case: not clearly malicious, but a real concern due to the executed binary from a non-mainstream host.