claude-config-bin

maintainer thisisayande · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt .deb binary from a GitHub release on a personal account without code review; if the source were swapped, an attacker could execute arbitrary code on the user's system.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt .deb binary from a GitHub release on a personal account without code review; if the source were swapped, an attacker could execute arbitrary code on the user's system.

PKGBUILD

      1# Maintainer: Ayan De <deayan252@gmail.com>
    
      2pkgname=claude-config-bin
    
      3pkgver=0.9.0
    
      4pkgrel=1
    
      5pkgdesc="Cross-platform provider manager for Claude Code"
    
      6arch=('x86_64')
    
      7url="https://github.com/ayan-de/claude-config"
    
      8license=('MIT')
    
      9depends=('webkit2gtk-4.1' 'gtk3')
    
      10provides=('claude-config')
    
      11conflicts=('claude-config')
    
      12options=('!strip')
    
      13source=("$pkgname-$pkgver.deb::$url/releases/download/v$pkgver/Claude.Config_${pkgver}_amd64.deb")
    
      14sha256sums=('3849d70657a6263805dbcd00feacfd2c327fea2a5b97438f64da7e480e0c3271')
    
      15
    
      16package() {
    
      17  bsdtar -xf data.tar.gz -C "$pkgdir"
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 13:35:00	MEDIUM	2