arduino-language-server-noclang-bin

maintainer ignaziovidoni · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs an unverifiable local script 'bundler' with skipped checksum and sudo privileges, posing a potential supply-chain risk if the script contains hidden malicious actions.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The PKGBUILD runs an unverifiable local script 'bundler' with skipped checksum and sudo privileges, posing a potential supply-chain risk if the script contains hidden malicious actions.

PKGBUILD

      1# Maintainer: KevinCrrl
    
      2
    
      3pkgname=arduino-language-server-noclang-bin
    
      4_pkgname=${pkgname%-noclang-bin}
    
      5pkgver=0.7.7
    
      6pkgrel=2
    
      7pkgdesc="An Arduino Language Server based on Clangd to Arduino code autocompletion\
    
      8 (Without using clang as a dependency, only clangd)"
    
      9arch=('x86_64')
    
      10url="https://github.com/arduino/arduino-language-server"
    
      11license=('AGPL3')
    
      12depends=('glibc' 'arduino-cli' 'clangd')
    
      13provides=('arduino-language-server')
    
      14conflicts=('arduino-language-server')
    
      15options=('!debug')
    
      16source=(
    
      17  'bundler'
    
      18)
    
      19sha512sums=(
    
      20  'SKIP'
    
      21)
    
      22
    
      23package() {
    
      24  sudo "$srcdir/bundler"
    
      25  install -Dm755 "$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      26}
    
      27
    
      28
    
      29

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -13,11 +13,17 @@
 provides=('arduino-language-server')
 conflicts=('arduino-language-server')
 options=('!debug')
-source=("$url/releases/download/$pkgver/${_pkgname}_${pkgver}_Linux_64bit.tar.gz")
-sha512sums=('ea4f8fb38b2eec7fe633841ab437606574292258c05d76d8eef80565097bf0694edcaac26a5b3931e3fb2f02194c42ca996d21c15487c5bae972249abc12675b')
+source=(
+  'bundler'
+)
+sha512sums=(
+  'SKIP'
+)
 
 package() {
+  sudo "$srcdir/bundler"
   install -Dm755 "$_pkgname" "$pkgdir/usr/bin/$_pkgname"
 }
 
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0