claude-code-stable-bin

maintainer theorangeguo · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary from a non-standard, non-whitelisted host (Google Cloud Storage bucket) which could be silently swapped, posing a supply-chain risk despite otherwise legitimate packaging.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_x86_64=(claude-code-stable-bin-2.1.205-x86_64::https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/2.1.205/linux-x64/claude )

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary from a non-standard, non-whitelisted host (Google Cloud Storage bucket) which could be silently swapped, posing a supply-chain risk despite otherwise legitimate packaging.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: theorangeguo
    
      2# Packaging Repo: https://github.com/theorangeguo/aur-packages/tree/main/packages/claude-code-stable-bin
    
      3pkgname=claude-code-stable-bin
    
      4pkgver=2.1.205
    
      5pkgrel=1
    
      6pkgdesc=Claude\ Code\ terminal-based\ AI\ coding\ assistant\ \(stable\ channel\)
    
      7arch=(x86_64 )
    
      8url=https://github.com/anthropics/claude-code
    
      9license=(LicenseRef-claude-code )
    
      10depends=(bash glibc )
    
      11makedepends=()
    
      12checkdepends=()
    
      13optdepends=(git:\ allow\ Claude\ Code\ to\ use\ git github-cli:\ interact\ with\ GitHub glab:\ interact\ with\ GitLab ripgrep:\ use\ system\ ripgrep\ if\ bundled\ search\ is\ disabled )
    
      14options=(\!strip )
    
      15provides=(claude-code claude-code-stable )
    
      16conflicts=(claude-code claude-code-bin claude-code-stable claude-code-latest claude-code-latest-bin )
    
      17validpgpkeys=()
    
      18install=claude-code-stable-bin.install
    
      19source=(claude-wrapper LICENSE.md::https://raw.githubusercontent.com/anthropics/claude-code/v2.1.205/LICENSE.md )
    
      20sha256sums=('91374907d431d091be80078090fb30dfb6e341b68f6dc73b74a4d9ffbf93a354'
    
      21            '728158fd1037143fad6907e8fa34804177e598b7326519503fe83cafdef849e6')
    
      22sha256sums_x86_64=('dd8734c0b6a503fe1d17425184e57b397c30bb0337a33f1470d9985febfe5b09')
    
      23source_x86_64=(claude-code-stable-bin-2.1.205-x86_64::https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/2.1.205/linux-x64/claude )
    
      24
    
      25_binary_source_path=claude-code-stable-bin-2.1.205-x86_64
    
      26_install_bin_path=/usr/lib/claude-code-stable-bin/claude
    
      27_wrapper_source_path=claude-wrapper
    
      28_wrapper_install_path=/usr/bin/claude
    
      29_wrapper_mode=755
    
      30_service_file=''
    
      31_service_install_path=''
    
      32_doc_files=()
    
      33_license_files=(LICENSE.md )
    
      34
    
      35
    
      36package() {
    
      37    _resolve_required_source_file() {
    
      38        local pattern=$1
    
      39        local matches=()
    
      40        local nullglob_was_set=false
    
      41
    
      42        shopt -q nullglob && nullglob_was_set=true
    
      43        shopt -s nullglob
    
      44        matches=("${srcdir}"/$pattern)
    
      45        [ "$nullglob_was_set" = true ] || shopt -u nullglob
    
      46
    
      47        if [ "${#matches[@]}" -ne 1 ]; then
    
      48            printf 'Expected exactly one source match for pattern %s, found %s\n' "$pattern" "${#matches[@]}" >&2
    
      49            return 1
    
      50        fi
    
      51
    
      52        [ -f "${matches[0]}" ] || {
    
      53            printf 'Matched source is not a file: %s\n' "${matches[0]}" >&2
    
      54            return 1
    
      55        }
    
      56
    
      57        printf '%s\n' "${matches[0]}"
    
      58    }
    
      59
    
      60    _install_optional_source_files() {
    
      61        local pattern=$1
    
      62        local target_dir=$2
    
      63        local mode=$3
    
      64        local matches=()
    
      65        local matched_file
    
      66        local nullglob_was_set=false
    
      67
    
      68        shopt -q nullglob && nullglob_was_set=true
    
      69        shopt -s nullglob
    
      70        matches=("${srcdir}"/$pattern)
    
      71        [ "$nullglob_was_set" = true ] || shopt -u nullglob
    
      72
    
      73        for matched_file in "${matches[@]}"; do
    
      74            [ -f "$matched_file" ] || continue
    
      75            install -Dm"$mode" "$matched_file" "${pkgdir}${target_dir}/$(basename "$matched_file")"
    
      76        done
    
      77    }
    
      78
    
      79    local binary_source_file
    
      80    binary_source_file=$(_resolve_required_source_file "${_binary_source_path}")
    
      81    install -Dm755 "$binary_source_file" "${pkgdir}${_install_bin_path}"
    
      82
    
      83    if [ -n "${_wrapper_source_path}" ] && [ -n "${_wrapper_install_path}" ]; then
    
      84        local wrapper_source_file
    
      85        wrapper_source_file=$(_resolve_required_source_file "${_wrapper_source_path}")
    
      86        install -Dm${_wrapper_mode} "$wrapper_source_file" "${pkgdir}${_wrapper_install_path}"
    
      87    fi
    
      88
    
      89    local doc_file
    
      90    for doc_file in "${_doc_files[@]}"; do
    
      91        _install_optional_source_files "$doc_file" "/usr/share/doc/${pkgname}" 644
    
      92    done
    
      93
    
      94    local license_file
    
      95    for license_file in "${_license_files[@]}"; do
    
      96        _install_optional_source_files "$license_file" "/usr/share/licenses/${pkgname}" 644
    
      97    done
    
      98
    
      99    if [ -n "${_service_file}" ] && [ -f "${srcdir}/${_service_file}" ]; then
    
      100        install -Dm644 "${srcdir}/${_service_file}" "${pkgdir}${_service_install_path}"
    
      101    fi
    
      102}
    
      103

Changes since previous scan

--- PKGBUILD @ 2026-07-17 00:06
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: theorangeguo
 # Packaging Repo: https://github.com/theorangeguo/aur-packages/tree/main/packages/claude-code-stable-bin
 pkgname=claude-code-stable-bin
-pkgver=2.1.204
+pkgver=2.1.205
 pkgrel=1
 pkgdesc=Claude\ Code\ terminal-based\ AI\ coding\ assistant\ \(stable\ channel\)
 arch=(x86_64 )
@@ -16,13 +16,13 @@
 conflicts=(claude-code claude-code-bin claude-code-stable claude-code-latest claude-code-latest-bin )
 validpgpkeys=()
 install=claude-code-stable-bin.install
-source=(claude-wrapper LICENSE.md::https://raw.githubusercontent.com/anthropics/claude-code/v2.1.204/LICENSE.md )
+source=(claude-wrapper LICENSE.md::https://raw.githubusercontent.com/anthropics/claude-code/v2.1.205/LICENSE.md )
 sha256sums=('91374907d431d091be80078090fb30dfb6e341b68f6dc73b74a4d9ffbf93a354'
             '728158fd1037143fad6907e8fa34804177e598b7326519503fe83cafdef849e6')
-sha256sums_x86_64=('c8ee1ea69154533c691a68f46abb645196fe7339d26e6fc204cc7f08220139d3')
-source_x86_64=(claude-code-stable-bin-2.1.204-x86_64::https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/2.1.204/linux-x64/claude )
+sha256sums_x86_64=('dd8734c0b6a503fe1d17425184e57b397c30bb0337a33f1470d9985febfe5b09')
+source_x86_64=(claude-code-stable-bin-2.1.205-x86_64::https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/2.1.205/linux-x64/claude )
 
-_binary_source_path=claude-code-stable-bin-2.1.204-x86_64
+_binary_source_path=claude-code-stable-bin-2.1.205-x86_64
 _install_bin_path=/usr/lib/claude-code-stable-bin/claude
 _wrapper_source_path=claude-wrapper
 _wrapper_install_path=/usr/bin/claude

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 03:53:53	MEDIUM	2
2026-07-17 00:06:16	LOW	2
2026-07-16 03:50:18	MEDIUM	1