codebuff-bin
HIGH
maintainer lapsus
0 votes
scanned 2026-08-31 01:44:31.582560
Why flagged
curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.
Triggered rules
High
Remote download executed by a shell
curl_pipe_shell
curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.
-
PKGBUILD:21
curl -fsSL 'https://registry.npmjs.org/codebuff/latest' | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])"
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/codebuff-linux-x64.tar.gz")
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
pkgname=codebuff-bin
3
pkgver=1.0.685
4
pkgrel=1
5
pkgdesc='AI coding agent for the terminal'
6
arch=('x86_64' 'aarch64')
7
url='https://codebuff.com'
8
license=('Apache-2.0')
9
depends=('glibc')
10
provides=('codebuff')
11
conflicts=('codebuff')
12
options=('!strip' '!debug')
13
14
source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/codebuff-linux-x64.tar.gz")
15
sha256sums_x86_64=('c3ce9019a5edd4ac76629e78050fdd69edc67604b0527a454d1bf6c4c64a7136')
16
sha256sums_aarch64=('4c57c8c2757ea650a119703aeff3ab7c05491a002953c0f0afbf6d1bc2a8e69a')
17
18
source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/codebuff-linux-arm64.tar.gz")
19
20
latestver() {
21
curl -fsSL 'https://registry.npmjs.org/codebuff/latest' | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])"
22
}
23
24
pkgver() {
25
latestver
26
}
27
28
package() {
29
install -Dm755 codebuff "${pkgdir}/usr/lib/codebuff/codebuff"
30
install -Dm644 tree-sitter.wasm "${pkgdir}/usr/lib/codebuff/tree-sitter.wasm"
31
install -d "${pkgdir}/usr/bin"
32
ln -s ../lib/codebuff/codebuff "${pkgdir}/usr/bin/codebuff"
33
ln -s ../lib/codebuff/codebuff "${pkgdir}/usr/bin/cb"
34
}
35
Changes since previous scan
--- PKGBUILD @ 2026-07-11 01:37+++ PKGBUILD @ 2026-08-31 01:44@@ -1,6 +1,6 @@ # Maintainer: Yakov Till <yakov.till@gmail.com> pkgname=codebuff-bin-pkgver=1.0.684+pkgver=1.0.685 pkgrel=1 pkgdesc='AI coding agent for the terminal' arch=('x86_64' 'aarch64')@@ -12,8 +12,8 @@ options=('!strip' '!debug') source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/codebuff-linux-x64.tar.gz")-sha256sums_x86_64=('2317ffd83964024fbfe536ce3bd57401a5b2aaa8bafdd36509df3398880cea2b')-sha256sums_aarch64=('5ef942aeffc40e0b70d61f237b9b057985c120917774f35caa2f7b4aba11ec4f')+sha256sums_x86_64=('c3ce9019a5edd4ac76629e78050fdd69edc67604b0527a454d1bf6c4c64a7136')+sha256sums_aarch64=('4c57c8c2757ea650a119703aeff3ab7c05491a002953c0f0afbf6d1bc2a8e69a') source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/codebuff-linux-arm64.tar.gz") Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-31 01:44:31 | High | 2 |
| 2026-08-11 17:34:14 | Clean | 3 |
| 2026-08-11 17:21:34 | High | 2 |
| 2026-07-11 01:37:58 | Clean | 3 |
| 2026-07-11 01:36:03 | High | 2 |
| 2026-07-11 00:25:18 | Low | 3 |
| 2026-07-10 00:20:30 | Low | 3 |
| 2026-07-09 00:22:38 | Low | 3 |
| 2026-07-08 00:26:52 | Low | 3 |
| 2026-07-07 00:22:52 | Low | 3 |
| 2026-07-06 00:10:58 | Low | 3 |
| 2026-07-05 00:27:08 | Low | 3 |
| 2026-07-04 00:27:25 | Low | 3 |
| 2026-07-03 00:17:07 | Low | 3 |
| 2026-07-02 00:22:12 | Low | 3 |
| 2026-07-01 12:41:32 | Low | 3 |
| 2026-06-20 00:50:07 | Clean | 3 |
| 2026-06-20 00:27:34 | Clean | 3 |
| 2026-06-20 00:18:46 | High | 2 |
| 2026-06-19 23:51:18 | Medium | 3 |