chipmunk-motif

LOW

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a JAR file from the project's official domain (autosome.ru) which is used as a bundled application; this is a standard AUR practice for Java tools, and the JAR is not executed during build but installed for user invocation, posing no unsanitized remote code execution risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JAR file from the project's official domain (autosome.ru) which is used as a bundled application; this is a standard AUR practice for Java tools, and the JAR is not executed during build but installed for user invocation, posing no unsanitized remote code execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("http://autosome.ru/ChIPMunk/chipmunk.jar")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: allencch <allencch at hotmail dot com>
    
      2pkgname=chipmunk-motif
    
      3pkgver=8
    
      4pkgrel=3
    
      5pkgdesc="Fast and efficient motif discovery tool, reborn and running"
    
      6arch=('any')
    
      7url="http://autosome.ru/ChIPMunk/"
    
      8license=('custom')
    
      9depends=("sh" "java-runtime")
    
      10source=("http://autosome.ru/ChIPMunk/chipmunk.jar")
    
      11sha256sums=('1dc81253be3dd016eff39a58d8ae142d9b6cccf1317a402596ae84715fd00b57')
    
      12
    
      13package() {
    
      14    mkdir -p "${pkgdir}/usr/bin"
    
      15    mkdir -p "${pkgdir}/opt/ChIPMunk"
    
      16    cd "${srcdir}"
    
      17    install -m755 chipmunk.jar "${pkgdir}/opt/ChIPMunk"
    
      18
    
      19    echo "#!/bin/sh" > ${pkgdir}/usr/bin/ChIPMunk
    
      20    echo 'java -jar /opt/ChIPMunk/chipmunk.jar "$@"' >> ${pkgdir}/usr/bin/ChIPMunk
    
      21    chmod 755 ${pkgdir}/usr/bin/ChIPMunk
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2