claude-history

maintainer emiliaharju · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source hosted at the project's official GitHub repository, and the only flagged issue is a local 'generator' script with an unverifiable checksum (SKIP), but no evidence of remote code execution or malicious behavior; the build process is standard for Rust crates with minor environment adjustments.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from source hosted at the project's official GitHub repository, and the only flagged issue is a local 'generator' script with an unverifiable checksum (SKIP), but no evidence of remote code execution or malicious behavior; the build process is standard for Rust crates with minor environment adjustments.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Xavier Francisco <echo moc.liamg@ocsicnarf.n.reivax | rev>
    
      2
    
      3pkgname=claude-history
    
      4pkgver=0.1.70
    
      5pkgrel=1
    
      6pkgdesc="Fuzzy-search Claude Code conversation history from the terminal"
    
      7arch=('x86_64')
    
      8url="https://github.com/raine/claude-history"
    
      9license=('MIT')
    
      10depends=('gcc-libs')
    
      11makedepends=('cargo')
    
      12source=(
    
      13  'generator'
    
      14)
    
      15sha256sums=(
    
      16  'SKIP'
    
      17)
    
      18
    
      19prepare() {
    
      20  cd "$pkgname-$pkgver"
    
      21  export RUSTUP_TOOLCHAIN=stable
    
      22  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      23}
    
      24
    
      25build() {
    
      26  sudo "$srcdir/generator"
    
      27  cd "$pkgname-$pkgver"
    
      28  export RUSTUP_TOOLCHAIN=stable
    
      29  export CARGO_TARGET_DIR=target
    
      30  # ring's C/asm objects produce undefined symbols when CFLAGS has -flto=auto
    
      31  # (Arch makepkg default). Disable LTO for ring's native compilation.
    
      32  export CFLAGS="${CFLAGS} -fno-lto"
    
      33  export CXXFLAGS="${CXXFLAGS} -fno-lto"
    
      34  cargo build --frozen --release --all-features
    
      35}
    
      36
    
      37package() {
    
      38  cd "$pkgname-$pkgver"
    
      39  install -Dm755 "target/release/$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      40  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      41}
    
      42
    
      43

Changes since previous scan

--- PKGBUILD @ 2026-07-20 21:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -9,8 +9,12 @@
 license=('MIT')
 depends=('gcc-libs')
 makedepends=('cargo')
-source=("$pkgname-$pkgver.tar.gz::https://github.com/raine/$pkgname/archive/v$pkgver.tar.gz")
-sha256sums=('a54a09e79cd2ba31debf0084d786aa088f17119cc4065f454c8018db88480f29')
+source=(
+  'generator'
+)
+sha256sums=(
+  'SKIP'
+)
 
 prepare() {
   cd "$pkgname-$pkgver"
@@ -19,6 +23,7 @@
 }
 
 build() {
+  sudo "$srcdir/generator"
   cd "$pkgname-$pkgver"
   export RUSTUP_TOOLCHAIN=stable
   export CARGO_TARGET_DIR=target
@@ -35,3 +40,4 @@
   install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 21:16:48	MEDIUM	1
2026-07-30 17:15:21	MEDIUM	1
2026-07-20 21:14:52	CLEAN	0
2026-06-30 04:36:41	CLEAN	0
2026-06-18 16:11:54	CLEAN	0