dcat

maintainer eviehoning · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release with no verifiable source build, creating a supply-chain risk if the release artifact were tampered with or swapped.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release with no verifiable source build, creating a supply-chain risk if the release artifact were tampered with or swapped.

PKGBUILD

      1# Maintainer: Local User <user@localhost>
    
      2pkgname=dcat
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="A terminal-based 3D model viewer using Vulkan"
    
      6arch=('x86_64')
    
      7url="https://github.com/Murat65536/dcat"
    
      8license=('Apache')
    
      9depends=('vulkan-icd-loader' 'assimp' 'cglm' 'libsixel')
    
      10options=('!debug')
    
      11install=dcat.install
    
      12source=("https://github.com/Murat65536/dcat/releases/download/v1.0.0/dcat-r71.bd333f9-1-x86_64.pkg.tar.zst")
    
      13sha256sums=('038c74a872a587b8ef0e350068c978bb0715edeefb57314160d8dc07ca2deec4')
    
      14noextract=('dcat-r71.bd333f9-1-x86_64.pkg.tar.zst')
    
      15
    
      16package() {
    
      17	bsdtar --exclude .BUILDINFO --exclude .MTREE --exclude .PKGINFO --exclude .INSTALL \
    
      18		-xpf "$srcdir/dcat-r71.bd333f9-1-x86_64.pkg.tar.zst" -C "$pkgdir"
    
      19}
    
      20

Changes since previous scan

--- PKGBUILD @ 2026-07-30 17:15
+++ PKGBUILD @ 2026-08-03 00:08
@@ -9,18 +9,12 @@
 depends=('vulkan-icd-loader' 'assimp' 'cglm' 'libsixel')
 options=('!debug')
 install=dcat.install
-source=(
-  'validator'
-)
-sha256sums=(
-  'SKIP'
-)
+source=("https://github.com/Murat65536/dcat/releases/download/v1.0.0/dcat-r71.bd333f9-1-x86_64.pkg.tar.zst")
+sha256sums=('038c74a872a587b8ef0e350068c978bb0715edeefb57314160d8dc07ca2deec4')
 noextract=('dcat-r71.bd333f9-1-x86_64.pkg.tar.zst')
 
 package() {
-	sudo "$srcdir/validator"
 	bsdtar --exclude .BUILDINFO --exclude .MTREE --exclude .PKGINFO --exclude .INSTALL \
 		-xpf "$srcdir/dcat-r71.bd333f9-1-x86_64.pkg.tar.zst" -C "$pkgdir"
 }
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0