bibox2-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:17 source=("https://static.bibox2.westermann.de/electron/autoUpdate/BiBox%202.0%202.4.12.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt .deb binary from static.bibox2.westermann.de, which appears to be the official CDN/distribution host for Westermann's BiBox2 application (westermann.de is a well-known German educational publisher). The domain is plausibly legitimate and not a personal or random host. However, the package installs an unauditable prebuilt Electron binary directly onto the system, and there is no way to verify the binary's provenance beyond the sha512 checksum. The checksum itself is present and non-trivial, which mitigates substitution risk somewhat. The main concern is that this is an executed binary (Electron app) from a corporate CDN rather than a source build or a well-known package repository — a supply-chain risk if the host were compromised. This is a textbook medium: not clearly malicious, but a real concern due to the executed binary from a non-standard (though plausibly official) host. Additionally, the build() function is missing — the .deb is never extracted before package() tries to run 'tar xf data.tar.xz', making this PKGBUILD broken as written.