codebuff-bin

HIGH
maintainer lapsus 0 votes scanned 2026-08-31 01:44:31.582560
View on AUR
Why flagged

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

Triggered rules

High Remote download executed by a shell curl_pipe_shell

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

  • PKGBUILD:21 curl -fsSL 'https://registry.npmjs.org/codebuff/latest' | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])"
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:14 source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/codebuff-linux-x64.tar.gz")

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: Yakov Till <yakov.till@gmail.com>
2pkgname=codebuff-bin
3pkgver=1.0.685
4pkgrel=1
5pkgdesc='AI coding agent for the terminal'
6arch=('x86_64' 'aarch64')
7url='https://codebuff.com'
8license=('Apache-2.0')
9depends=('glibc')
10provides=('codebuff')
11conflicts=('codebuff')
12options=('!strip' '!debug')
13
14source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/codebuff-linux-x64.tar.gz")
15sha256sums_x86_64=('c3ce9019a5edd4ac76629e78050fdd69edc67604b0527a454d1bf6c4c64a7136')
16sha256sums_aarch64=('4c57c8c2757ea650a119703aeff3ab7c05491a002953c0f0afbf6d1bc2a8e69a')
17
18source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/codebuff-linux-arm64.tar.gz")
19
20latestver() {
21 curl -fsSL 'https://registry.npmjs.org/codebuff/latest' | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])"
22}
23
24pkgver() {
25 latestver
26}
27
28package() {
29 install -Dm755 codebuff "${pkgdir}/usr/lib/codebuff/codebuff"
30 install -Dm644 tree-sitter.wasm "${pkgdir}/usr/lib/codebuff/tree-sitter.wasm"
31 install -d "${pkgdir}/usr/bin"
32 ln -s ../lib/codebuff/codebuff "${pkgdir}/usr/bin/codebuff"
33 ln -s ../lib/codebuff/codebuff "${pkgdir}/usr/bin/cb"
34}
35

Changes since previous scan

--- PKGBUILD @ 2026-07-11 01:37
+++ PKGBUILD @ 2026-08-31 01:44
@@ -1,6 +1,6 @@
# Maintainer: Yakov Till <yakov.till@gmail.com>
pkgname=codebuff-bin
-pkgver=1.0.684
+pkgver=1.0.685
pkgrel=1
pkgdesc='AI coding agent for the terminal'
arch=('x86_64' 'aarch64')
@@ -12,8 +12,8 @@
options=('!strip' '!debug')
source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/codebuff-linux-x64.tar.gz")
-sha256sums_x86_64=('2317ffd83964024fbfe536ce3bd57401a5b2aaa8bafdd36509df3398880cea2b')
-sha256sums_aarch64=('5ef942aeffc40e0b70d61f237b9b057985c120917774f35caa2f7b4aba11ec4f')
+sha256sums_x86_64=('c3ce9019a5edd4ac76629e78050fdd69edc67604b0527a454d1bf6c4c64a7136')
+sha256sums_aarch64=('4c57c8c2757ea650a119703aeff3ab7c05491a002953c0f0afbf6d1bc2a8e69a')
source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/codebuff-linux-arm64.tar.gz")

Scan history

Scanned at (UTC)SeverityRules
2026-08-31 01:44:31 High 2
2026-08-11 17:34:14 Clean 3
2026-08-11 17:21:34 High 2
2026-07-11 01:37:58 Clean 3
2026-07-11 01:36:03 High 2
2026-07-11 00:25:18 Low 3
2026-07-10 00:20:30 Low 3
2026-07-09 00:22:38 Low 3
2026-07-08 00:26:52 Low 3
2026-07-07 00:22:52 Low 3
2026-07-06 00:10:58 Low 3
2026-07-05 00:27:08 Low 3
2026-07-04 00:27:25 Low 3
2026-07-03 00:17:07 Low 3
2026-07-02 00:22:12 Low 3
2026-07-01 12:41:32 Low 3
2026-06-20 00:50:07 Clean 3
2026-06-20 00:27:34 Clean 3
2026-06-20 00:18:46 High 2
2026-06-19 23:51:18 Medium 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion