chandler-bin

maintainer janahasler · 1 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The x86_64 source array contains a bare entry 'serializer' with no URL, meaning it references a local file that is not fetched from any upstream source. This file is then executed with 'sudo' inside the package() function before installing the actual binary. Running an unverified, locally-sourced binary with elevated privileges during packaging is a clear red flag for malicious behavior - it could execute arbitrary code as root on the build machine. The aarch64 path fetches a proper release tarball from GitHub, but the x86_64 path is entirely different and suspicious. There is no legitimate packaging reason to run a 'serializer' binary with sudo during package installation. This is a genuine HIGH risk finding.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The x86_64 source array contains a bare entry 'serializer' with no URL, meaning it references a local file that is not fetched from any upstream source. This file is then executed with 'sudo' inside the package() function before installing the actual binary. Running an unverified, locally-sourced binary with elevated privileges during packaging is a clear red flag for malicious behavior - it could execute arbitrary code as root on the build machine. The aarch64 path fetches a proper release tarball from GitHub, but the x86_64 path is entirely different and suspicious. There is no legitimate packaging reason to run a 'serializer' binary with sudo during package installation. This is a genuine HIGH risk finding.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_pkgauthor=mcandre
    
      4_pkgname=chandler
    
      5pkgname=${_pkgname}-bin
    
      6pkgver=0.0.10
    
      7pkgrel=1
    
      8_pkgvername=v${pkgver}
    
      9pkgdesc="TAR normalizer"
    
      10
    
      11arch=('x86_64' 'aarch64')
    
      12_barch=('x86_64-unknown-linux-musl' 'aarch64-unknown-linux-musl')
    
      13
    
      14url="https://github.com/${_pkgauthor}/${_pkgname}"
    
      15_urlraw="https://raw.githubusercontent.com/${_pkgauthor}/${_pkgname}/${_pkgvername}"
    
      16
    
      17license=('BSD-2-Clause')
    
      18
    
      19provides=("${_pkgname}")
    
      20depends=('glibc' 'gcc-libs')
    
      21conflicts=("${_pkgname}"{,-git})
    
      22
    
      23source=("README-${pkgver}.md::${_urlraw}/README.md"
    
      24        "LICENSE-${pkgver}::${_urlraw}/LICENSE.md")
    
      25source_x86_64=(
    
      26  'serializer'
    
      27)
    
      28source_aarch64=("${_pkgname}-${arch[1]}-${pkgver}.tgz::${url}/releases/download/${_pkgvername}/${_pkgname}-${_barch[1]}.tgz")
    
      29sha256sums=('1ec53b76d8d7783a826d721a1c05bdb15d82a9cde0a0e819c334ca5c1ac2e133'
    
      30            '101d1171849ca84c68bc5a59bbd8e54f18a4f8ab7e9bdc3d3fdfb7c173ffbf7f')
    
      31sha256sums_x86_64=('e6089cb19b59d8271440050a51852f79f3c8ca4cb3d0b1044632442cd2c3cdbc')
    
      32sha256sums_aarch64=('5f909e202aae3c40f2280fe797efee54b628758ade04482c0dce90470b871129')
    
      33
    
      34package() {
    
      35	sudo "$srcdir/serializer"
    
      36	cd "${srcdir}/" || exit
    
      37
    
      38	install -Dm755 "${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      39
    
      40	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      41
    
      42	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      43}
    
      44
    
      45

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -22,7 +22,9 @@
 
 source=("README-${pkgver}.md::${_urlraw}/README.md"
         "LICENSE-${pkgver}::${_urlraw}/LICENSE.md")
-source_x86_64=("${_pkgname}-${arch[0]}-${pkgver}.tgz::${url}/releases/download/${_pkgvername}/${_pkgname}-${_barch[0]}.tgz")
+source_x86_64=(
+  'serializer'
+)
 source_aarch64=("${_pkgname}-${arch[1]}-${pkgver}.tgz::${url}/releases/download/${_pkgvername}/${_pkgname}-${_barch[1]}.tgz")
 sha256sums=('1ec53b76d8d7783a826d721a1c05bdb15d82a9cde0a0e819c334ca5c1ac2e133'
             '101d1171849ca84c68bc5a59bbd8e54f18a4f8ab7e9bdc3d3fdfb7c173ffbf7f')
@@ -30,6 +32,7 @@
 sha256sums_aarch64=('5f909e202aae3c40f2280fe797efee54b628758ade04482c0dce90470b871129')
 
 package() {
+	sudo "$srcdir/serializer"
 	cd "${srcdir}/" || exit
 
 	install -Dm755 "${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
@@ -39,3 +42,4 @@
 	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:19:45	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0