badapple-hd
The package downloads a video file and a script from the project's own GitHub repository; the script is installed as an executable, but both sources are from a plausible project-owned host, and the worst case of a swapped source is limited to non-executable data or a benign script.
Triggered rules
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a video file and a script from the project's own GitHub repository; the script is installed as an executable, but both sources are from a plausible project-owned host, and the worst case of a swapped source is limited to non-executable data or a benign script.
PKGBUILD
pkgname=badapple-hd
pkgver=1.0.0
pkgrel=1
pkgdesc="Play badapple in your terminal in the highest quality possible!"
arch=('any')
url="https://github.com/Raj-1727/badapple-hd"
license=('MIT')
depends=(
'python'
'ffmpeg'
'figlet'
'lolcat'
)
source=(
"badapple-hd"
"badapple.mp4::https://raw.githubusercontent.com/Raj-1727/badapple-hd/main/badapple.mp4"
)
sha256sums=(
'SKIP'
'SKIP'
)
package() {
install -Dm755 "$srcdir/badapple-hd" \
"$pkgdir/usr/bin/badapple-hd"
install -Dm644 "$srcdir/badapple.mp4" \
"$pkgdir/usr/share/badapple-hd/badapple-hd/badapple.mp4"
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 07:25:15 | Low | 2 |