beatoraja-modernchic

maintainer koh11235813 · 6 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary archive (a zip containing a Java application with native libraries) from mocha-repository.info, which is not the official upstream GitHub repository (github.com/exch-bms2/beatoraja). This is a 'modernchic' skin/variant build hosted on a third-party site. The archive is not built from source — it is installed directly into /opt and executed. While there is a sha256sum check providing some integrity guarantee, the host is unofficial and personal, meaning if the host or the file is replaced the checksum would need to be updated by the maintainer. The 'modernchic' variant appears to be a community skin pack for beatoraja distributed via this third-party mirror rather than the official project releases. This constitutes a real supply-chain concern: a prebuilt binary bundle (including native .so libraries bundled in the zip) from a non-official host is being installed and executed. The chmod -R 777 on the installed directory is also a poor security practice but not a direct attack vector. Overall this is a genuine medium-severity supply-chain risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://mocha-repository.info/download/beatoraja${pkgver}-modernchic.zip" 'beatoraja.sh' 'beatoraja.desktop')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary archive (a zip containing a Java application with native libraries) from mocha-repository.info, which is not the official upstream GitHub repository (github.com/exch-bms2/beatoraja). This is a 'modernchic' skin/variant build hosted on a third-party site. The archive is not built from source — it is installed directly into /opt and executed. While there is a sha256sum check providing some integrity guarantee, the host is unofficial and personal, meaning if the host or the file is replaced the checksum would need to be updated by the maintainer. The 'modernchic' variant appears to be a community skin pack for beatoraja distributed via this third-party mirror rather than the official project releases. This constitutes a real supply-chain concern: a prebuilt binary bundle (including native .so libraries bundled in the zip) from a non-official host is being installed and executed. The chmod -R 777 on the installed directory is also a poor security practice but not a direct attack vector. Overall this is a genuine medium-severity supply-chain risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: koh11235813 <koh11235813 at gmail dot com>
    
      2# Contributor: nullobsi <me at nullob dot si>
    
      3pkgname=beatoraja-modernchic
    
      4pkgver=0.8.8
    
      5pkgrel=1
    
      6pkgdesc="Cross-platform rhythm game based on Java and libGDX."
    
      7arch=('x86_64')
    
      8url="https://github.com/exch-bms2/beatoraja"
    
      9license=('GPL3' 'unknown')
    
      10groups=()
    
      11optdepends=('mesa: for OpenGL support (recommended)')
    
      12depends=('xorg-xrandr' 'jre21-openjdk' 'java21-openjfx')
    
      13makedepends=()
    
      14install=
    
      15source=("https://mocha-repository.info/download/beatoraja${pkgver}-modernchic.zip" 'beatoraja.sh' 'beatoraja.desktop')
    
      16noextract=()
    
      17sha256sums=('c89c2890e95d34251dbcfb57ab2d4e2f61121a9e38ebf6990507af7ad1a5a7b4'
    
      18            'e71a8db5b93b768b04dc558e0b4478bf2edcaf890fd424873a7a0f760f0ee06b'
    
      19            'de5e7ec93e501d139502d7433fcc67e1c305b8dc10c25edf362178274808f773')
    
      20
    
      21build() {
    
      22	cd "$srcdir/beatoraja${pkgver}-modernchic"
    
      23	rm beatoraja-config.bat
    
      24	rm beatoraja-config.command
    
      25	rm jportaudio_x64.dll
    
      26	rm portaudio_x64.dll
    
      27}
    
      28
    
      29package() {
    
      30	cd "$srcdir/"
    
      31	mkdir "$pkgdir/opt"
    
      32	cp -r "beatoraja${pkgver}-modernchic" "$pkgdir/opt/beatoraja"
    
      33	chmod -R 777 "$pkgdir/opt/beatoraja"
    
      34	install -Dm777 beatoraja.sh "$pkgdir/usr/bin/beatoraja"
    
      35	install -Dm644 beatoraja.desktop "$pkgdir/usr/share/applications/beatoraja.desktop"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2