ctpkg

maintainer Franca · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt/pre-written script ('ctpkg') is downloaded from a personal CDN host (cdngit.ruzhtw.top) operated by the maintainer themselves, with no integrity verification (sha256sums=SKIP). The file is installed directly as an executable at /usr/bin/ctpkg with mode 755. Even if this is a Fish shell script rather than a compiled binary, it is executed code from an unofficial personal host with no checksum, meaning it could be silently replaced at any time with arbitrary code that runs as the user (or root via sudo, which is a declared dependency). This is a genuine supply-chain concern: no integrity check, personal CDN, executable installed system-wide. Not clearly malicious, but a real medium-severity risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://cdngit.ruzhtw.top/pkghub/ctpkg")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): A prebuilt/pre-written script ('ctpkg') is downloaded from a personal CDN host (cdngit.ruzhtw.top) operated by the maintainer themselves, with no integrity verification (sha256sums=SKIP). The file is installed directly as an executable at /usr/bin/ctpkg with mode 755. Even if this is a Fish shell script rather than a compiled binary, it is executed code from an unofficial personal host with no checksum, meaning it could be silently replaced at any time with arbitrary code that runs as the user (or root via sudo, which is a declared dependency). This is a genuine supply-chain concern: no integrity check, personal CDN, executable installed system-wide. Not clearly malicious, but a real medium-severity risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: TeaHouseLab(aka. Tsingkwai) <tsingkwai at ruzh dot top>
    
      2pkgname="ctpkg"
    
      3pkgver="55"
    
      4pkgrel="4"
    
      5pkgdesc="A bridge for different package managers , and a userland package manager included , written in progynosh(fish)"
    
      6arch=("x86_64")
    
      7url="https://ruzhtw.top/pages/projects/CenterLinux/CTPM"
    
      8depends=("fish" "sudo")
    
      9license=("GPL-3.0 License")
    
      10provides=("ctpkg")
    
      11source=("https://cdngit.ruzhtw.top/pkghub/ctpkg")
    
      12sha256sums=("SKIP")
    
      13install='hooks.install'
    
      14package() {
    
      15	install -m755 -D "${srcdir}/ctpkg" "${pkgdir}/usr/bin/ctpkg"
    
      16	}
    
      17
    
      18

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2