cryptodredge

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("${pkgname}-${pkgver}.tar.gz::https://cryptodredge.org/download/linux/11.4/latest")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): This PKGBUILD downloads and installs a prebuilt closed-source binary (a cryptocurrency miner) directly from the project's own domain (cryptodredge.org) using a 'latest' URL endpoint rather than a versioned, immutable release artifact. Several concerns: (1) The URL path ends in '/latest' which is a mutable pointer — even though an md5sum is present, md5 is cryptographically broken and trivially collisable, providing weak integrity assurance. (2) The binary is a closed-source, proprietary GPU miner installed directly to /usr/bin with no source code review possible. (3) The license is declared 'none' and the LICENSE.txt installation is commented out, indicating the legal status is unclear. (4) While cryptodredge.org is the legitimate upstream vendor site, it is not an established, widely-audited distribution channel like GitHub releases or a distro mirror. The combination of a mutable 'latest' URL, a broken checksum algorithm (md5), and a closed-source executed binary constitutes a genuine supply-chain risk: if the host is compromised or the 'latest' pointer is updated maliciously, users would receive and execute arbitrary code. This is a real medium-severity concern, not a false positive.