crypto-market

LOW

maintainer simonschubert 0 votes scanned 2026-09-27 15:19:08.759284

View on AUR

Why flagged

Package builds from a release asset on the project's GitHub, which is normal for AUR; the low severity is due to few votes and recent upload, not malicious content.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): Package builds from a release asset on the project's GitHub, which is normal for AUR; the low severity is due to few votes and recent upload, not malicious content.

PKGBUILD

      1# Maintainer: Simon Schubert <simon@librem.one>
    
      2#
    
      3# Crypto Market as an app: the QML tree in /usr/share/crypto-market, started
    
      4# by /usr/bin/crypto-market. That launcher opens it in the running Omarchy
    
      5# shell when the plugin is installed there, and as its own Quickshell process
    
      6# everywhere else -- so this package needs Quickshell, not Omarchy.
    
      7pkgname=crypto-market
    
      8pkgver=1.1.1
    
      9pkgrel=1
    
      10pkgdesc='CoinGecko prices, coin pages, a watchlist and a portfolio, for Quickshell'
    
      11arch=('any')
    
      12url='https://github.com/SimonSchubert/moarchy-apps'
    
      13license=('MIT')
    
      14# qt6-declarative (QtQuick, QtQuick.Shapes) comes with quickshell. The icons
    
      15# are Nerd Font glyphs, which namcap cannot see, so it calls this dependency
    
      16# unneeded -- as it does quickshell, for the same reason.
    
      17depends=('quickshell' 'ttf-jetbrains-mono-nerd' 'hicolor-icon-theme')
    
      18# A release asset that packaging/release.sh builds from apps/crypto-market at
    
      19# the tag, not GitHub's generated archive of the whole repository.
    
      20source=("$url/releases/download/crypto-market-v$pkgver/$pkgname-$pkgver.tar.gz")
    
      21sha256sums=('879e5a93196bc3c3bf3cb6346a306f98c6561de3ce3859ca558c3b3557e97909')
    
      22
    
      23package() {
    
      24  cd "$pkgname-$pkgver"
    
      25
    
      26  install -d "$pkgdir/usr/share/$pkgname"
    
      27  install -m644 manifest.json ./*.qml ./*.js ./*.mjs icon.svg \
    
      28    "$pkgdir/usr/share/$pkgname/"
    
      29
    
      30  install -Dm755 bin/crypto-market "$pkgdir/usr/bin/crypto-market"
    
      31  install -Dm644 crypto-market.desktop "$pkgdir/usr/share/applications/crypto-market.desktop"
    
      32  install -Dm644 icon.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/crypto-market.svg"
    
      33  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 15:19:08	Low	2