aur-sync-vote-bin

maintainer susannahiltunen · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build() function runs a sudo command on an unverified local script 'decoder', which could execute arbitrary code with elevated privileges and is not reviewable in the source array.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The build() function runs a sudo command on an unverified local script 'decoder', which could execute arbitrary code with elevated privileges and is not reviewable in the source array.

PKGBUILD

      1# Maintainer: acaibowlz <hankthedev@gmail.com>
    
      2pkgname=aur-sync-vote-bin
    
      3pkgver=0.3.0
    
      4pkgrel=1
    
      5pkgdesc="Syncing votes with the currently installed AUR packages"
    
      6arch=('any')
    
      7url="https://github.com/acaibowlz/aur-sync-vote"
    
      8license=('MIT')
    
      9depends=('python-beautifulsoup4' 'python-html5lib' 'python-requests' 'python-keyring')
    
      10makedepends=('python-build' 'python-installer' 'python-setuptools' 'python-wheel')
    
      11optdepends=(
    
      12  'org.freedesktop.secrets: password saving'
    
      13)
    
      14source=("aur-sync-vote-bin-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz" 'decoder')
    
      15sha256sums=('424b868796d8c995312208669331a4246df21761b7e603a7c6e04b1f6a953cdb')
    
      16
    
      17build() {
    
      18  sudo "$srcdir/decoder"
    
      19  cd "$srcdir/aur-sync-vote-bin-$pkgver"
    
      20  python -m build --wheel --no-isolation
    
      21}
    
      22
    
      23package() {
    
      24  cd "$srcdir/aur-sync-vote-bin-$pkgver"
    
      25  python -m installer --destdir="$pkgdir" dist/*.whl
    
      26
    
      27  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/aur-sync-vote-bin/LICENSE"
    
      28  install -Dm644 README.md "$pkgdir/usr/share/doc/aur-sync-vote-bin/README.md"
    
      29}
    
      30
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 11:20:22	MEDIUM	2