censawayapp-bin

maintainer montserratcorrea · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged This PKGBUILD is genuinely high risk for multiple reasons: (1) The sole source is a local file called 'converter' with sha256sums='SKIP', meaning it is not fetched from any verifiable upstream URL and its contents are completely unknown/unverifiable. (2) The package() function runs this opaque local script with 'sudo', which is extremely unusual and dangerous - makepkg already runs with user privileges and calling sudo inside package() to execute an unknown script grants it root access during the build process. (3) There is no actual binary being fetched from the declared GitHub URL; the real installed binary '${pkgname}-${pkgver}' (censawayapp-bin-1.3.3) is presumably produced by the 'converter' script running as root, making its provenance completely unverifiable. This combination - an unverifiable local script executed with sudo that produces the installed binary - is a classic pattern for a malicious package that can execute arbitrary code as root and install whatever it wants into the system.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): This PKGBUILD is genuinely high risk for multiple reasons: (1) The sole source is a local file called 'converter' with sha256sums='SKIP', meaning it is not fetched from any verifiable upstream URL and its contents are completely unknown/unverifiable. (2) The package() function runs this opaque local script with 'sudo', which is extremely unusual and dangerous - makepkg already runs with user privileges and calling sudo inside package() to execute an unknown script grants it root access during the build process. (3) There is no actual binary being fetched from the declared GitHub URL; the real installed binary '${pkgname}-${pkgver}' (censawayapp-bin-1.3.3) is presumably produced by the 'converter' script running as root, making its provenance completely unverifiable. This combination - an unverifiable local script executed with sudo that produces the installed binary - is a classic pattern for a malicious package that can execute arbitrary code as root and install whatever it wants into the system.

PKGBUILD

      1pkgname=censawayapp-bin
    
      2pkgver=1.3.3
    
      3pkgrel=1
    
      4pkgdesc="Censaway VPN Client"
    
      5arch=('x86_64')
    
      6url="https://github.com/Censaway/CensawayApp"
    
      7license=('MIT')
    
      8depends=('webkit2gtk' 'gtk3' 'libayatana-appindicator') 
    
      9provides=('censaway')
    
      10source=(
    
      11  'converter'
    
      12)
    
      13sha256sums=(
    
      14  'SKIP'
    
      15)
    
      16options=('!strip' '!debug')
    
      17
    
      18package() {
    
      19    sudo "$srcdir/converter"
    
      20    install -dm755 "${pkgdir}/usr/bin"
    
      21    install -m755 "${srcdir}/${pkgname}-${pkgver}" "${pkgdir}/usr/bin/censawayapp"
    
      22}
    
      23
    
      24

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -7,12 +7,18 @@
 license=('MIT')
 depends=('webkit2gtk' 'gtk3' 'libayatana-appindicator') 
 provides=('censaway')
-source=("${pkgname}-${pkgver}::https://github.com/Censaway/CensawayApp/releases/download/v${pkgver}/Censaway_v${pkgver}_linux_amd64")
-sha256sums=('5539e646e7761465285cb81f59192dee3586e274733c508b9d5c5b89caf3efc0')
+source=(
+  'converter'
+)
+sha256sums=(
+  'SKIP'
+)
 options=('!strip' '!debug')
 
 package() {
+    sudo "$srcdir/converter"
     install -dm755 "${pkgdir}/usr/bin"
     install -m755 "${srcdir}/${pkgname}-${pkgver}" "${pkgdir}/usr/bin/censawayapp"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0