berrydash

maintainer Lncvrt · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary (a Unity/game executable zip) from a personal/unofficial host (games-r2.lncvrt.xyz) operated by the maintainer themselves. This is a real supply-chain concern: the host is not an official upstream release mirror, there is no way to independently verify the binary's provenance, and if the host is compromised or the maintainer acts maliciously, arbitrary code would be executed on the user's system. The sha256sum provides integrity checking against tampering in transit, but does not verify the binary's origin or trustworthiness. The binary is installed to /opt and executed directly. This is a classic AUR pattern for self-hosted game binaries and is not clearly malicious, but it does represent a genuine medium-severity supply-chain risk since the executed binary comes from an unverifiable personal host rather than an established upstream release channel.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "https://games-r2.lncvrt.xyz/berry-dash/Berry-Dash-$pkgver-linux.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary (a Unity/game executable zip) from a personal/unofficial host (games-r2.lncvrt.xyz) operated by the maintainer themselves. This is a real supply-chain concern: the host is not an official upstream release mirror, there is no way to independently verify the binary's provenance, and if the host is compromised or the maintainer acts maliciously, arbitrary code would be executed on the user's system. The sha256sum provides integrity checking against tampering in transit, but does not verify the binary's origin or trustworthiness. The binary is installed to /opt and executed directly. This is a classic AUR pattern for self-hosted game binaries and is not clearly malicious, but it does represent a genuine medium-severity supply-chain risk since the executed binary comes from an unverifiable personal host rather than an established upstream release channel.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lncvrt <lncvrtreal@gmail.com>
    
      2
    
      3pkgname=berrydash
    
      4pkgver=26.1
    
      5pkgrel=1
    
      6pkgdesc="A simple game where you catch berries with a leaderboard system and more."
    
      7arch=('x86_64')
    
      8url="https://berrydash.lncvrt.xyz/"
    
      9license=('GPL3')
    
      10depends=()
    
      11makedepends=('unzip')
    
      12options=(!strip !debug)
    
      13source=(
    
      14  "https://games-r2.lncvrt.xyz/berry-dash/Berry-Dash-$pkgver-linux.zip"
    
      15  "berrydash.desktop"
    
      16  "berrydash.png"
    
      17)
    
      18sha256sums=(
    
      19  'd43ec9fd5acdfa210c674655a481343fdb9db7a60d0d0f3960ba44e433d768ca'
    
      20  'a27dae1b8f41d289c04ce9ede426e4938be5ba882cd51d57fee35718ecea2829'
    
      21  '79273f068c2ea02c96fb9ff095de6263bcea3ff0f7d3e5aa06efe2ccf5da027c'
    
      22)
    
      23
    
      24prepare() {
    
      25  mkdir -p "$srcdir/game"
    
      26  bsdtar -xf "Berry-Dash-$pkgver-linux.zip" -C "$srcdir/game"
    
      27}
    
      28
    
      29package() {
    
      30  install -d "$pkgdir/opt/$pkgname"
    
      31  cp -a "$srcdir/game/." "$pkgdir/opt/$pkgname/"
    
      32  install -Dm755 /dev/stdin "$pkgdir/usr/bin/$pkgname" <<EOF
    
      33#!/bin/bash
    
      34cd /opt/$pkgname
    
      35exec ./Berry\ Dash.x86_64
    
      36EOF
    
      37  install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      38  install -Dm644 "$srcdir/$pkgname.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/$pkgname.png"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2