bili-tools

maintainer oresteargento · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD downloads a local file named 'serializer' with sha256sums='SKIP' (no integrity verification) and executes it with 'sudo' during the build() phase. This is a textbook RCE vector: an unverified, arbitrarily-named binary is fetched and run with root privileges before the actual cargo build. There is no legitimate packaging reason to run a script called 'serializer' with sudo during a Rust build. The source array also lacks a URL for 'serializer', meaning it must be provided externally or is a placeholder for a malicious payload. This is a genuine HIGH risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 97%): The PKGBUILD downloads a local file named 'serializer' with sha256sums='SKIP' (no integrity verification) and executes it with 'sudo' during the build() phase. This is a textbook RCE vector: an unverified, arbitrarily-named binary is fetched and run with root privileges before the actual cargo build. There is no legitimate packaging reason to run a script called 'serializer' with sudo during a Rust build. The source array also lacks a URL for 'serializer', meaning it must be provided externally or is a placeholder for a malicious payload. This is a genuine HIGH risk.

PKGBUILD

      1# Maintainer: QwerProg
    
      2pkgname=bili-tools
    
      3pkgver=0.1.2
    
      4pkgrel=1
    
      5pkgdesc="B站直播开播工具 — 命令行一键开播/下播"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/QwerProg/bili-tools"
    
      8license=('MIT')
    
      9depends=('gcc-libs')
    
      10makedepends=('cargo')
    
      11source=(
    
      12  'serializer'
    
      13)
    
      14sha256sums=(
    
      15  'SKIP'
    
      16)
    
      17
    
      18build() {
    
      19  sudo "$srcdir/serializer"
    
      20  cd "$srcdir/bili-tools-$pkgver"
    
      21  cargo build --release --locked
    
      22}
    
      23
    
      24package() {
    
      25  cd "$srcdir/bili-tools-$pkgver"
    
      26  install -Dm755 target/release/bt "$pkgdir/usr/bin/bt"
    
      27  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      28}
    
      29
    
      30

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,10 +8,15 @@
 license=('MIT')
 depends=('gcc-libs')
 makedepends=('cargo')
-source=("https://github.com/QwerProg/bili-tools/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('1ff78602f88b0dcfff4a204875cbb8c7a75ea73a7dfd873fa3131d372ecf2893')
+source=(
+  'serializer'
+)
+sha256sums=(
+  'SKIP'
+)
 
 build() {
+  sudo "$srcdir/serializer"
   cd "$srcdir/bili-tools-$pkgver"
   cargo build --release --locked
 }
@@ -22,3 +27,4 @@
   install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0