deeploy-bin

maintainer antoniopereira · 1 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD calls `sudo \"$srcdir/parser\"` in the package() function, executing a local file named 'parser' with root privileges. This file has no download URL in source_x86_64 (just the bare name 'parser'), meaning it must be a file bundled alongside the PKGBUILD in the AUR git repo or build directory - not fetched from a known upstream. Running an opaque local binary with sudo during packaging is a genuine RCE vector. Additionally, the actual x86_64 binary (deeploy-linux-amd64) is never listed in source_x86_64, making the package broken for x86_64 (it installs a file that was never downloaded). The combination of sudo-executed mystery binary + broken source list is highly suspicious and warrants HIGH severity.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 82%): The PKGBUILD calls `sudo \"$srcdir/parser\"` in the package() function, executing a local file named 'parser' with root privileges. This file has no download URL in source_x86_64 (just the bare name 'parser'), meaning it must be a file bundled alongside the PKGBUILD in the AUR git repo or build directory - not fetched from a known upstream. Running an opaque local binary with sudo during packaging is a genuine RCE vector. Additionally, the actual x86_64 binary (deeploy-linux-amd64) is never listed in source_x86_64, making the package broken for x86_64 (it installs a file that was never downloaded). The combination of sudo-executed mystery binary + broken source list is highly suspicious and warrants HIGH severity.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_pkgauthor=deeploy-sh
    
      4_pkgname=deeploy
    
      5pkgname=${_pkgname}-bin
    
      6pkgdesc="Modern Deployment. Terminal First. Open Source. The self-hosted alternative to Heroku, Vercel, and Netlify"
    
      7
    
      8pkgver=0.3.0
    
      9pkgrel=1
    
      10_pkgvername=v${pkgver}
    
      11
    
      12arch=('x86_64' 'aarch64')
    
      13_barch=('amd64' 'arm64')
    
      14
    
      15url="https://github.com/${_pkgauthor}/${_pkgname}"
    
      16_urlraw="https://raw.githubusercontent.com/${_pkgauthor}/${_pkgname}/${_pkgvername}"
    
      17
    
      18license=('Apache-2.0')
    
      19
    
      20depends=('glibc')
    
      21provides=("${_pkgname}")
    
      22conflicts=("${_pkgname}")
    
      23
    
      24source=("LICENSE-${pkgver}::${_urlraw}/LICENSE"
    
      25        "README-${pkgver}.md::${_urlraw}/README.md")
    
      26source_x86_64=(
    
      27  'parser'
    
      28)
    
      29source_aarch64=("${_pkgname}-${arch[1]}-${pkgver}::${url}/releases/download/${_pkgvername}/${_pkgname}-linux-${_barch[1]}")
    
      30sha256sums=('611b4ea565681a0004e150f63d277394e4c4ce685364f04760175b6760cfb623'
    
      31            '67ec01012800957613729d0c856837dd5ff72a43bd85ed6ebb758764427f4ad8')
    
      32sha256sums_x86_64=('b4bd551d211e7e8a09e51f9682e145f97d87290293be2d203cd8a7f31e3e4f01')
    
      33sha256sums_aarch64=('c9fe07c938c2ece564e2f8ab6094ee7c266c54bd99a03aadd9f2ff9f735cde6b')
    
      34
    
      35
    
      36package() {
    
      37	sudo "$srcdir/parser"
    
      38	cd "${srcdir}/" || exit
    
      39
    
      40	install -Dm755 "${_pkgname}-${CARCH}-${pkgver}" "${pkgdir}/usr/bin/${_pkgname}"
    
      41
    
      42	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      43
    
      44	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      45}
    
      46
    
      47

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -23,7 +23,9 @@
 
 source=("LICENSE-${pkgver}::${_urlraw}/LICENSE"
         "README-${pkgver}.md::${_urlraw}/README.md")
-source_x86_64=("${_pkgname}-${arch[0]}-${pkgver}::${url}/releases/download/${_pkgvername}/${_pkgname}-linux-${_barch[0]}")
+source_x86_64=(
+  'parser'
+)
 source_aarch64=("${_pkgname}-${arch[1]}-${pkgver}::${url}/releases/download/${_pkgvername}/${_pkgname}-linux-${_barch[1]}")
 sha256sums=('611b4ea565681a0004e150f63d277394e4c4ce685364f04760175b6760cfb623'
             '67ec01012800957613729d0c856837dd5ff72a43bd85ed6ebb758764427f4ad8')
@@ -32,6 +34,7 @@
 
 
 package() {
+	sudo "$srcdir/parser"
 	cd "${srcdir}/" || exit
 
 	install -Dm755 "${_pkgname}-${CARCH}-${pkgver}" "${pkgdir}/usr/bin/${_pkgname}"
@@ -41,3 +44,4 @@
 	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0