craftbukkit-plugin-worldedit

LOW

maintainer lauramasseron 5 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt JAR file from a non-whitelisted host, but it is the official release of a well-known Minecraft plugin, and the JAR is installed as a data artifact without being executed during build; the worst case of a swapped source is limited to code execution in the Minecraft server context, which is typical for AUR plugins and not inherently malicious in this ecosystem.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt JAR file from a non-whitelisted host, but it is the official release of a well-known Minecraft plugin, and the JAR is installed as a data artifact without being executed during build; the worst case of a swapped source is limited to code execution in the Minecraft server context, which is typical for AUR plugins and not inherently malicious in this ecosystem.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 source=("https://mediafilez.forgecdn.net/files/4586/220/worldedit-bukkit-${pkgver}.jar")

PKGBUILD

1 offending line(s) highlighted

      1pkgname=craftbukkit-plugin-worldedit
    
      2pkgver=7.2.15
    
      3pkgrel=1
    
      4pkgdesc="easy-to-use in-game world editor for Minecraft, supporting both single player and multiplayer"
    
      5arch=(any)
    
      6url="http://dev.bukkit.org/bukkit-plugins/worldedit"
    
      7license=("GPLv3")
    
      8source=("https://mediafilez.forgecdn.net/files/4586/220/worldedit-bukkit-${pkgver}.jar")
    
      9sha256sums=('06f38bf47e456b95e521984bceb365bb479499f28e40545d36323a5378e50ca3')
    
      10
    
      11package() {
    
      12  install -Dm644 worldedit-bukkit-$pkgver.jar "$pkgdir/srv/craftbukkit/plugins/worldedit-bukkit.jar"
    
      13}
    
      14

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2