claude-code-stable-bin
MEDIUM
maintainer theorangeguo
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt binary from a non-standard, non-whitelisted host (Google Cloud Storage bucket) which could be silently swapped, posing a supply-chain risk despite otherwise legitimate packaging.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source_x86_64=(claude-code-stable-bin-2.1.205-x86_64::https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/2.1.205/linux-x64/claude )
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary from a non-standard, non-whitelisted host (Google Cloud Storage bucket) which could be silently swapped, posing a supply-chain risk despite otherwise legitimate packaging.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: theorangeguo
2
# Packaging Repo: https://github.com/theorangeguo/aur-packages/tree/main/packages/claude-code-stable-bin
3
pkgname=claude-code-stable-bin
4
pkgver=2.1.205
5
pkgrel=1
6
pkgdesc=Claude\ Code\ terminal-based\ AI\ coding\ assistant\ \(stable\ channel\)
7
arch=(x86_64 )
8
url=https://github.com/anthropics/claude-code
9
license=(LicenseRef-claude-code )
10
depends=(bash glibc )
11
makedepends=()
12
checkdepends=()
13
optdepends=(git:\ allow\ Claude\ Code\ to\ use\ git github-cli:\ interact\ with\ GitHub glab:\ interact\ with\ GitLab ripgrep:\ use\ system\ ripgrep\ if\ bundled\ search\ is\ disabled )
14
options=(\!strip )
15
provides=(claude-code claude-code-stable )
16
conflicts=(claude-code claude-code-bin claude-code-stable claude-code-latest claude-code-latest-bin )
17
validpgpkeys=()
18
install=claude-code-stable-bin.install
19
source=(claude-wrapper LICENSE.md::https://raw.githubusercontent.com/anthropics/claude-code/v2.1.205/LICENSE.md )
20
sha256sums=('91374907d431d091be80078090fb30dfb6e341b68f6dc73b74a4d9ffbf93a354'
21
'728158fd1037143fad6907e8fa34804177e598b7326519503fe83cafdef849e6')
22
sha256sums_x86_64=('dd8734c0b6a503fe1d17425184e57b397c30bb0337a33f1470d9985febfe5b09')
23
source_x86_64=(claude-code-stable-bin-2.1.205-x86_64::https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/2.1.205/linux-x64/claude )
24
25
_binary_source_path=claude-code-stable-bin-2.1.205-x86_64
26
_install_bin_path=/usr/lib/claude-code-stable-bin/claude
27
_wrapper_source_path=claude-wrapper
28
_wrapper_install_path=/usr/bin/claude
29
_wrapper_mode=755
30
_service_file=''
31
_service_install_path=''
32
_doc_files=()
33
_license_files=(LICENSE.md )
34
35
36
package() {
37
_resolve_required_source_file() {
38
local pattern=$1
39
local matches=()
40
local nullglob_was_set=false
41
42
shopt -q nullglob && nullglob_was_set=true
43
shopt -s nullglob
44
matches=("${srcdir}"/$pattern)
45
[ "$nullglob_was_set" = true ] || shopt -u nullglob
46
47
if [ "${#matches[@]}" -ne 1 ]; then
48
printf 'Expected exactly one source match for pattern %s, found %s\n' "$pattern" "${#matches[@]}" >&2
49
return 1
50
fi
51
52
[ -f "${matches[0]}" ] || {
53
printf 'Matched source is not a file: %s\n' "${matches[0]}" >&2
54
return 1
55
}
56
57
printf '%s\n' "${matches[0]}"
58
}
59
60
_install_optional_source_files() {
61
local pattern=$1
62
local target_dir=$2
63
local mode=$3
64
local matches=()
65
local matched_file
66
local nullglob_was_set=false
67
68
shopt -q nullglob && nullglob_was_set=true
69
shopt -s nullglob
70
matches=("${srcdir}"/$pattern)
71
[ "$nullglob_was_set" = true ] || shopt -u nullglob
72
73
for matched_file in "${matches[@]}"; do
74
[ -f "$matched_file" ] || continue
75
install -Dm"$mode" "$matched_file" "${pkgdir}${target_dir}/$(basename "$matched_file")"
76
done
77
}
78
79
local binary_source_file
80
binary_source_file=$(_resolve_required_source_file "${_binary_source_path}")
81
install -Dm755 "$binary_source_file" "${pkgdir}${_install_bin_path}"
82
83
if [ -n "${_wrapper_source_path}" ] && [ -n "${_wrapper_install_path}" ]; then
84
local wrapper_source_file
85
wrapper_source_file=$(_resolve_required_source_file "${_wrapper_source_path}")
86
install -Dm${_wrapper_mode} "$wrapper_source_file" "${pkgdir}${_wrapper_install_path}"
87
fi
88
89
local doc_file
90
for doc_file in "${_doc_files[@]}"; do
91
_install_optional_source_files "$doc_file" "/usr/share/doc/${pkgname}" 644
92
done
93
94
local license_file
95
for license_file in "${_license_files[@]}"; do
96
_install_optional_source_files "$license_file" "/usr/share/licenses/${pkgname}" 644
97
done
98
99
if [ -n "${_service_file}" ] && [ -f "${srcdir}/${_service_file}" ]; then
100
install -Dm644 "${srcdir}/${_service_file}" "${pkgdir}${_service_install_path}"
101
fi
102
}
103
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |