controlcenter
maintainer WeeXnes
· 0 votes
· scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged
The package builds from source hosted on the maintainer's own domain, which is not whitelisted but plausibly project-owned; the downloaded tarball is used to build a web interface with Nuxt, and no unreviewed prebuilt binaries or obfuscated payloads are executed; the SKIP'd checksums are a quality issue but do not enable remote code execution given the context.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on the maintainer's own domain, which is not whitelisted but plausibly project-owned; the downloaded tarball is used to build a web interface with Nuxt, and no unreviewed prebuilt binaries or obfuscated payloads are executed; the SKIP'd checksums are a quality issue but do not enable remote code execution given the context.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("${pkgname}-${pkgver}.tar.gz::https://code.weexnes.dev/~downloads/projects/73/archives?revision=${pkgver}&format=tgz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: WeeXnes <weexnes@weexnes.dev>
2
3
pkgname=controlcenter
4
pkgver=2.8.3
5
pkgrel=1
6
pkgdesc="ControlCenter Web Interface built with Nuxt (stable version)"
7
arch=('any')
8
url="https://code.weexnes.dev/ControlCenter"
9
license=('GPL3')
10
depends=('nodejs')
11
makedepends=('npm')
12
provides=('controlcenter')
13
conflicts=('controlcenter-git')
14
options=('!strip')
15
install=controlcenter.install
16
source=("${pkgname}-${pkgver}.tar.gz::https://code.weexnes.dev/~downloads/projects/73/archives?revision=${pkgver}&format=tgz"
17
"controlcenter.service")
18
sha256sums=('SKIP'
19
'SKIP')
20
21
build() {
22
cd "$srcdir"
23
# Install all dependencies for build
24
npm install
25
# Build the Nuxt application
26
npm run build
27
# Prune devDependencies to keep package size minimal
28
npm prune --omit=dev
29
}
30
31
package() {
32
# Install build output
33
install -d "$pkgdir/opt/controlcenter"
34
cp -r "$srcdir/.output/"* "$pkgdir/opt/controlcenter/"
35
36
# Replace the symlinked node_modules with the real production node_modules
37
rm -rf "$pkgdir/opt/controlcenter/server/node_modules"
38
cp -r "$srcdir/node_modules" "$pkgdir/opt/controlcenter/server/"
39
40
# Install systemd service
41
install -Dm644 "$srcdir/controlcenter.service" "$pkgdir/usr/lib/systemd/system/controlcenter.service"
42
}
43
Changes since previous scan
--- PKGBUILD @ 2026-08-17 15:36+++ PKGBUILD @ 2026-08-18 00:03@@ -1,7 +1,7 @@ # Maintainer: WeeXnes <weexnes@weexnes.dev> pkgname=controlcenter-pkgver=2.7.0+pkgver=2.8.3 pkgrel=1 pkgdesc="ControlCenter Web Interface built with Nuxt (stable version)" arch=('any')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | LOW | 3 |
| 2026-08-17 17:37:06 | MEDIUM | 2 |
| 2026-08-17 15:36:47 | MEDIUM | 2 |
| 2026-08-17 01:34:23 | MEDIUM | 2 |
| 2026-08-17 00:18:29 | LOW | 3 |
| 2026-08-16 23:34:04 | MEDIUM | 2 |
| 2026-08-16 21:33:47 | MEDIUM | 2 |
| 2026-08-16 00:03:42 | LOW | 3 |
| 2026-08-15 00:26:13 | LOW | 3 |
| 2026-08-14 00:03:41 | LOW | 3 |
| 2026-08-13 00:17:07 | LOW | 3 |
| 2026-08-12 00:27:08 | LOW | 3 |
| 2026-08-11 19:31:27 | LOW | 3 |
| 2026-08-11 19:21:46 | MEDIUM | 3 |