bend-bin

MEDIUM

maintainer rnbguy 0 votes scanned 2026-09-18 00:17:11.210425

View on AUR

Why flagged

The package downloads a prebuilt tarball (TypeScript source) from bend-lang.com, a non-standard host with no verifiable connection to an official upstream project repository; while the checksum is present, the host is a personal/project domain that could be swapped, and the package installs and executes this code via bun at runtime, making a silently swapped tarball a real code-execution risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("bend-${pkgver}.tar.gz::https://bend-lang.com/dl/${pkgver}.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): The package downloads a prebuilt tarball (TypeScript source) from bend-lang.com, a non-standard host with no verifiable connection to an official upstream project repository; while the checksum is present, the host is a personal/project domain that could be swapped, and the package installs and executes this code via bun at runtime, making a silently swapped tarball a real code-execution risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ranadeep Biswas <mail@rnbguy.at>
    
      2pkgname=bend-bin
    
      3pkgver=2.0.4
    
      4pkgrel=1
    
      5pkgdesc='Bend programming language'
    
      6arch=('any')
    
      7license=('Apache-2.0')
    
      8depends=('bun')
    
      9optdepends=('clang: compile Bend programs to native binaries (clang 14+, 19+ for GPU programs)'
    
      10            'cuda: build and run GPU programs on NVIDIA GPUs')
    
      11provides=('bend')
    
      12source=("bend-${pkgver}.tar.gz::https://bend-lang.com/dl/${pkgver}.tar.gz")
    
      13sha256sums=('dff7d7e7b42a4572c79d3084093521d198a93af4684d4a10fe8322c265481734')
    
      14
    
      15# To update: open https://bend-lang.com/dl/latest.json, copy its "ver" into
    
      16# the pkgver literal above and its "sha256" into sha256sums, then rebuild.
    
      17# Upstream publishes no buildable source, only a versioned release tarball
    
      18# (pure TypeScript + C/JS effect snippets) behind a self-updating launcher
    
      19# (install.sh). The launcher POSTs telemetry to /ping, rewrites
    
      20# ~/.bend/current on every run, and races concurrent invocations, so this
    
      21# package skips it: /usr/bin/bend invokes the release directly under the
    
      22# system bun. Tarball's main.ts performs no telemetry itself (only
    
      23# bend --publish contacts BEND_HUB).
    
      24
    
      25package() {
    
      26  # Upstream hardcodes the NVIDIA-default /usr/local/cuda (existence check,
    
      27  # -I/-L flags in bend2/main.ts cli_build); Arch's cuda package lives at
    
      28  # /opt/cuda. Patch the source, don't ship a /usr/local symlink (that tree
    
      29  # is the admin's, not the package manager's).
    
      30  sed -i 's|/usr/local/cuda|/opt/cuda|g' bend2/main.ts
    
      31  install -dm755 "${pkgdir}/usr/lib/bend"
    
      32  cp -a bend2 guide "${pkgdir}/usr/lib/bend/"
    
      33  find "${pkgdir}/usr/lib/bend" -type d -exec chmod 755 {} +
    
      34  find "${pkgdir}/usr/lib/bend" -type f -exec chmod 644 {} +
    
      35
    
      36  install -dm755 "${pkgdir}/usr/bin"
    
      37  printf '#!/bin/sh\nexec /usr/bin/bun /usr/lib/bend/bend2/main.ts "$@"\n' \
    
      38    > "${pkgdir}/usr/bin/bend"
    
      39  chmod 755 "${pkgdir}/usr/bin/bend"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-18 00:17:11	Medium	3
2026-09-17 23:28:28	Medium	3
2026-09-17 23:26:45	Medium	2