biglybt-extreme-mod

maintainer orphaned · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and executes two sources: (1) the official BiglyBT installer shell script from GitHub releases (legitimate), and (2) a prebuilt mod ZIP from sb-innovation.de, a third-party forum/community site. The mod ZIP is extracted directly into /opt/pkgname/ on top of the installed BiglyBT files, meaning any JARs or binaries inside it are executed with full user privileges when BiglyBT runs. The host sb-innovation.de is not the upstream project's official release infrastructure — it appears to be a BitTorrent client modding community forum. The ZIP contains 'multiple spoofing capabilities' per the description, and its contents are not auditable from the PKGBUILD alone. sha512sums are present for both sources, which mitigates the risk of in-transit tampering, but does not address the trustworthiness of the original content or the host. This is a genuine medium-severity supply-chain concern: executed code (JARs/binaries) from an unofficial third-party host with no code-signing or reproducibility guarantees.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "BiglyBT_${pkgver}_${_modver}.zip::https://www.sb-innovation.de/attachment.php?attachmentid=21389&d=http://www.sb-innovation.de/attachment.php?attachmentid=21389&d=1665759448")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads and executes two sources: (1) the official BiglyBT installer shell script from GitHub releases (legitimate), and (2) a prebuilt mod ZIP from sb-innovation.de, a third-party forum/community site. The mod ZIP is extracted directly into /opt/pkgname/ on top of the installed BiglyBT files, meaning any JARs or binaries inside it are executed with full user privileges when BiglyBT runs. The host sb-innovation.de is not the upstream project's official release infrastructure — it appears to be a BitTorrent client modding community forum. The ZIP contains 'multiple spoofing capabilities' per the description, and its contents are not auditable from the PKGBUILD alone. sha512sums are present for both sources, which mitigates the risk of in-transit tampering, but does not address the trustworthiness of the original content or the host. This is a genuine medium-severity supply-chain concern: executed code (JARs/binaries) from an unofficial third-party host with no code-signing or reproducibility guarantees.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: robertfoster
    
      2# Contributor: Det <nimetonmaili gmail a-dot com>
    
      3
    
      4pkgname=biglybt-extreme-mod
    
      5pkgver=3.2.0.0
    
      6_ver=${pkgver/b*/}
    
      7_modver=20221014
    
      8pkgrel=1
    
      9pkgdesc="A modded version of the BiglyBT client with multiple spoofing capabilities"
    
      10arch=('x86_64')
    
      11url="http://www.sb-innovation.de/f41/"
    
      12license=('GPL3')
    
      13depends=('desktop-file-utils' 'xdg-user-dirs' 'java-runtime>=8')
    
      14optdepends=('jna' 'libappindicator-gtk3' 'ttf-dejavu')
    
      15options=('!strip')
    
      16install=${pkgname}.install
    
      17source=("GitHub_BiglyBT_Installer_${pkgver}.sh::https://github.com/BiglySoftware/BiglyBT/releases/download/v$_ver/GitHub_BiglyBT_Installer.sh"
    
      18  "BiglyBT_${pkgver}_${_modver}.zip::https://www.sb-innovation.de/attachment.php?attachmentid=21389&d=http://www.sb-innovation.de/attachment.php?attachmentid=21389&d=1665759448")
    
      19noextract=($(basename ${source[1]}))
    
      20sha512sums=('959a1b81c160512407a0695557158c7d3fe823eef2f9cd572bbeaa4be7bc798962e52db517cdbb7c1a97f24715c1aed45b00f897bb4aa3611a312cb5373fd722'
    
      21            'f21e4b90a84ce60b9757b7d749d525663898ede49787f43e11aa74ca1ca5a271527dd84a4ab799e04a36490e20fc71c0c408ccd4356e4c0a8fd40bda2fd90504')
    
      22
    
      23package() {
    
      24  if [[ ! -f /usr/bin/javac ]]; then
    
      25    warning "Installation without JDK will cause prompts for Root password during build!"
    
      26  fi
    
      27
    
      28  if [[ -d "${pkgname}" ]]; then
    
      29    msg2 "Cleaning build environment..."
    
      30    rm -r "${pkgname}"
    
      31  fi
    
      32
    
      33  msg2 "Extracting GitHub_BiglyBT_Installer_${pkgver}.sh..."
    
      34  export app_java_home="/usr/lib/jvm/default"
    
      35
    
      36  # Prevent the installer from creating files in the user's homedir
    
      37  export HOME="${srcdir}/home"
    
      38  mkdir -p ${srcdir}/home/{Desktop,.local/share/applications}
    
      39
    
      40  sh "GitHub_BiglyBT_Installer_${pkgver}.sh" -q -dir "${srcdir}/${pkgname}"
    
      41
    
      42  cd "${srcdir}/${pkgname}"
    
      43
    
      44  msg2 "Creating directory structure..."
    
      45  install -d "${pkgdir}/opt/${pkgname}/"
    
      46  install -d "${pkgdir}/usr/bin/"
    
      47  install -d "${pkgdir}/usr/share/applications/"
    
      48  install -d "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      49  install -d "${pkgdir}/usr/share/pixmaps/"
    
      50
    
      51  msg2 "Moving stuff in place..."
    
      52  # Launchers
    
      53  mv biglybt "${pkgdir}/usr/bin/${pkgname}"
    
      54
    
      55  # Icon and desktop
    
      56  mv biglybt.svg "${pkgdir}/usr/share/pixmaps/${pkgname}.svg"
    
      57  mv biglybt.desktop "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      58
    
      59  # Licenses
    
      60  mv 3rdPartyLicences.txt GPL.txt GPLv3.txt "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      61
    
      62  msg2 "Removing redundancies..."
    
      63  rm swt/swt-{bsd,ppc64,ppc64le,x86}.jar
    
      64  rm biglybt-lightgray.svg biglybt.png
    
      65  rm installer.log
    
      66  rm {,un}registerBiglyBT uninstall updateBiglyBT
    
      67
    
      68  msg2 "Installing to /opt..."
    
      69  mv * "${pkgdir}/opt/${pkgname}/"
    
      70
    
      71  msg2 "Fixing paths..."
    
      72  sed -i "s|#PROGRAM_DIR=.*|PROGRAM_DIR=\"/opt/${pkgname}\"|" "${pkgdir}/usr/bin/${pkgname}"
    
      73  sed -e "s|Name=.*|Name=BiglyBT Extreme Mod|" -e "s|Exec=.*|Exec=${pkgname} %U|" -e "s|Icon=.*|Icon=${pkgname}|" \
    
      74    -i "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      75
    
      76  msg2 "Installing Extreme Mod..."
    
      77  bsdtar -xf "${srcdir}/BiglyBT_${pkgver}_${_modver}.zip" -C "${pkgdir}/opt/${pkgname}/"
    
      78}
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2