delta-media-player

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs a prebuilt binary (.deb) from the vendor's own website (deltamediaplayer.com), which matches the package's stated upstream URL. The sha256 checksum is present and pinned, which mitigates casual tampering. However, this is still a closed-source prebuilt binary from a small, non-mainstream vendor with no independent verification path (no GPG signature, no mirror). The package also claims GPL3 but ships a prebuilt binary with bundled proprietary-looking libraries (libssl, libcrypto, libevent are stripped out, suggesting the .deb bundles them). Installing an unverifiable prebuilt binary from a small vendor's own server is a genuine supply-chain concern: if deltamediaplayer.com is compromised, users get a malicious binary with a valid checksum only at the time of PKGBUILD authoring. This is a textbook medium-severity supply-chain risk — not clearly malicious, but a real concern due to the executed binary from a non-auditable source.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://www.deltamediaplayer.com/playercode/download/DeltaMediaPlayer-$pkgver.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs a prebuilt binary (.deb) from the vendor's own website (deltamediaplayer.com), which matches the package's stated upstream URL. The sha256 checksum is present and pinned, which mitigates casual tampering. However, this is still a closed-source prebuilt binary from a small, non-mainstream vendor with no independent verification path (no GPG signature, no mirror). The package also claims GPL3 but ships a prebuilt binary with bundled proprietary-looking libraries (libssl, libcrypto, libevent are stripped out, suggesting the .deb bundles them). Installing an unverifiable prebuilt binary from a small vendor's own server is a genuine supply-chain concern: if deltamediaplayer.com is compromised, users get a malicious binary with a valid checksum only at the time of PKGBUILD authoring. This is a textbook medium-severity supply-chain risk — not clearly malicious, but a real concern due to the executed binary from a non-auditable source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dracorp aka Piotr Rogoza <piotr.r.public at gmail.com>
    
      2
    
      3pkgname=delta-media-player
    
      4pkgver=1.23
    
      5pkgrel=1
    
      6pkgdesc='IPTV program stream player for DMPlayer'
    
      7arch=('i686' 'x86_64')
    
      8url='http://www.deltamediaplayer.com/en/'
    
      9license=('GPL3')
    
      10depends=('vlc' 'qt5-tools' 'openssl-1.0' 'libevent>=2.1.8')
    
      11makedepends=('chrpath')
    
      12provides=('dmplayer')
    
      13source=("https://www.deltamediaplayer.com/playercode/download/DeltaMediaPlayer-$pkgver.deb")
    
      14sha256sums=('d34d4765ee4f7cfb5bac10cc71f5c6b6eb300ffdf9f394a27f316f214bf6d927')
    
      15
    
      16package() {
    
      17  cd "$srcdir"
    
      18  bsdtar -xf data.tar.xz
    
      19  install -dm755 "$pkgdir"/usr
    
      20  mv usr/local/* "$pkgdir"/usr
    
      21  chrpath -d "$pkgdir"/usr/bin/dmplayer
    
      22  sed 's#/local##' -i "$pkgdir"/usr/share/applications/DeltaMediaPlayer.desktop
    
      23  rm -f "$pkgdir"/usr/lib/libssl* "$pkgdir"/usr/lib/libcrypto*
    
      24  rm -f "$pkgdir"/usr/lib/libevent*.so
    
      25}
    
      26
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2