chipdisco

maintainer milkii · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt JAR binary from a Firebase/Google Cloud Storage URL (the developer's personal app storage bucket) with a token-authenticated URL and SKIP'd checksum. While Firebase Storage is a legitimate hosting service and the URL appears to be the developer's own distribution channel (matching the official project URL domain echolevel.co.uk), the combination of: (1) a prebuilt executable JAR with no source build, (2) SKIP'd checksum providing zero integrity verification, and (3) a mutable token-authenticated URL that could be swapped at any time without detection, constitutes a genuine supply-chain concern. The JAR is executed directly via java -jar, so any substitution would result in code execution. This is a real medium-severity concern — not clearly malicious, but an unofficial/personal host serving an executed binary with no integrity check.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://firebasestorage.googleapis.com/v0/b/echolevel-b069e.appspot.com/o/files%2FChipdisco6.1_Linux.zip?alt=media&token=82d65992-6dc9-4acc-8c05-4b3e0011884d")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt JAR binary from a Firebase/Google Cloud Storage URL (the developer's personal app storage bucket) with a token-authenticated URL and SKIP'd checksum. While Firebase Storage is a legitimate hosting service and the URL appears to be the developer's own distribution channel (matching the official project URL domain echolevel.co.uk), the combination of: (1) a prebuilt executable JAR with no source build, (2) SKIP'd checksum providing zero integrity verification, and (3) a mutable token-authenticated URL that could be swapped at any time without detection, constitutes a genuine supply-chain concern. The JAR is executed directly via java -jar, so any substitution would result in code execution. This is a real medium-severity concern — not clearly malicious, but an unofficial/personal host serving an executed binary with no integrity check.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Milk Brewster (milk on freenode irc)
    
      2pkgname=chipdisco
    
      3pkgver=6.1
    
      4pkgrel=1
    
      5epoch=
    
      6pkgdesc="a dual-deck DJ app for tracker modules (.MOD/.XM/.S3M)"
    
      7arch=('x86_64')
    
      8url="https://echolevel.co.uk/post/1486312636973-Chipdisco"
    
      9license=('unknown')
    
      10groups=()
    
      11depends=('unzip' )
    
      12makedepends=()
    
      13checkdepends=()
    
      14optdepends=()
    
      15provides=()
    
      16conflicts=()
    
      17replaces=()
    
      18backup=()
    
      19options=()
    
      20install=
    
      21changelog=
    
      22source=("https://firebasestorage.googleapis.com/v0/b/echolevel-b069e.appspot.com/o/files%2FChipdisco6.1_Linux.zip?alt=media&token=82d65992-6dc9-4acc-8c05-4b3e0011884d")
    
      23noextract=()
    
      24md5sums=('SKIP')
    
      25validpgpkeys=()
    
      26# 
    
      27# prepare() {
    
      28	# cd "$srcdir/Chipdisco6.1_Linux/  
    
      29# }
    
      30# 
    
      31# build() {
    
      32	# cd "$srcdir"
    
      33# }
    
      34# 
    
      35# check() {
    
      36	# cd "$pkgname-$pkgver"
    
      37	# make -k check
    
      38# }
    
      39# 
    
      40package() {
    
      41	cd "$srcdir"
    
      42  echo "#!/bin/sh" > chipdisco
    
      43  echo "exec /usr/bin/java -jar '/usr/share/java/chipdisco/Chipdisco6.jar' '$@'" >> chipdisco
    
      44	install -D -m755 "${srcdir}/chipdisco" "${pkgdir}/usr/bin/chipdisco"
    
      45	install -D -m755 "${srcdir}/Chipdisco6.1_Linux/lib/Chipdisco6.jar" "${pkgdir}/usr/share/java/chipdisco/Chipdisco6.jar"
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2