dict

maintainer Connor · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary package from a personal/unofficial domain (software.concise.cc) rather than from the upstream GitLab repository. While checksums (sha512 and md5) are provided and a PGP key is listed for validation, the source is still a personal host controlled by the maintainer rather than an official release mirror. Additionally, the package() function runs 'yarn install' or 'npm install' inside the extracted package directory, which fetches and executes additional npm dependencies at build time — this is a second supply-chain vector. The combination of a prebuilt binary from a personal host plus runtime npm dependency installation during packaging represents a genuine medium-severity supply-chain concern, even if not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "https://software.concise.cc/x86_64/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.xz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary package from a personal/unofficial domain (software.concise.cc) rather than from the upstream GitLab repository. While checksums (sha512 and md5) are provided and a PGP key is listed for validation, the source is still a personal host controlled by the maintainer rather than an official release mirror. Additionally, the package() function runs 'yarn install' or 'npm install' inside the extracted package directory, which fetches and executes additional npm dependencies at build time — this is a second supply-chain vector. The combination of a prebuilt binary from a personal host plus runtime npm dependency installation during packaging represents a genuine medium-severity supply-chain concern, even if not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Etherington <connor@concise.cc>
    
      2# ---
    
      3pkgname=dict
    
      4pkgver=0.1.0
    
      5pkgrel=1
    
      6pkgdesc="An easy to use english dictionary for the command line."
    
      7arch=(any)
    
      8url="https://gitlab.com/a4to/${pkgname}"
    
      9license=('MIT')
    
      10install="${pkgname}.install"
    
      11depends=('nodejs' 'npm')
    
      12source=(
    
      13  "https://software.concise.cc/x86_64/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.xz"
    
      14)
    
      15sha512sums=(
    
      16  '45aa05a64d9083fb4edd6e8b7cba661e0e09b15ae00fd64b185b7ad0874df5dddc8a4204b6e3ef4eb38b4b80327bf0ae9412ff1aa0422614819a37d2694ccbc9'
    
      17)
    
      18md5sums=(
    
      19  'bca763480b69f2f8e57d6cdbbb2517e0'
    
      20)
    
      21validpgpkeys=(
    
      22  '81BACEEBC3EA26E127166E4A819BB92A9A48160E'
    
      23)
    
      24
    
      25package() {
    
      26
    
      27  [ -d "${srcdir}/${pkgname}-${pkgver}-${pkgrel}-${arch}/usr/lib/node_modules/${pkgname}" ] &&
    
      28    cd "${srcdir}/${pkgname}-${pkgver}-${pkgrel}-${arch}/usr/lib/node_modules/${pkgname}" ||
    
      29    cd "${srcdir}/${pkgname}/usr/lib/node_modules/${pkgname}"
    
      30
    
      31  which yarn >/dev/null 2>&1 && yarn install || npm install
    
      32
    
      33  cd ../../../../
    
      34
    
      35  install -dm0755 "${pkgdir}"/usr/lib/node_modules/${pkgname}
    
      36  install -Dm0644 usr/share/licenses/${pkgname}/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      37
    
      38  !which ${pkgname} >/dev/null 2>&1 && install -Dm0755 usr/bin/* -t "${pkgdir}/usr/bin/" ||
    
      39    install -Dm0755 usr/bin/${pkgname} "${pkgdir}/usr/bin/${pkgname}"
    
      40
    
      41  cp -ar usr/lib/node_modules/${pkgname}/* "${pkgdir}"/usr/lib/node_modules/${pkgname}
    
      42  install -dm0755 "${pkgdir}"/usr/lib/node_modules/${pkgname}
    
      43
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2