dropbix

MEDIUM

maintainer marchos1as 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Package name 'dropbix' is a likely typosquat of the legitimate 'dropbox' AUR package; bundled local files (service files, terms.txt, SVG) and an unrevealed .install hook cannot be verified, and the duplicate pkgrel assignment at the bottom is suspicious, though the actual binary is fetched from official Dropbox CDN with PGP verification.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 "https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-$pkgver.tar.gz"{,.asc})

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 72%): Package name 'dropbix' is a likely typosquat of the legitimate 'dropbox' AUR package; bundled local files (service files, terms.txt, SVG) and an unrevealed .install hook cannot be verified, and the duplicate pkgrel assignment at the bottom is suspicious, though the actual binary is fetched from official Dropbox CDN with PGP verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Massimiliano Torromeo <massimiliano.torromeo@gmail.com>
    
      2# Contributor: Chih-Hsuan Yen <yan12125@gmail.com>
    
      3# Contributor: Tom < tomgparchaur at gmail dot com >
    
      4# Contributor: David Manouchehri <d@32t.ca>
    
      5
    
      6pkgname=dropbix
    
      7pkgver=272.4.3798
    
      8pkgrel=1
    
      9pkgdesc="A free service that lets you bring your photos, docs, and videos anywhere and share them easily."
    
      10arch=("x86_64")
    
      11url="https://www.dropbox.com"
    
      12license=(custom:Dropbox)
    
      13depends=("libsm" "libxslt" "libxmu" "libxdamage" "libxrender" "libxxf86vm" "libxcomposite" "fontconfig" "dbus")
    
      14makedepends=("gendesk")
    
      15optdepends=(
    
      16  'ufw-extras: ufw rules for dropbox'
    
      17  'perl-file-mimeinfo: opening dropbox folder on some desktop environments'
    
      18  'xdg-utils: for "Launch Dropbox Website" and file manager integration'
    
      19  'libappindicator-gtk3: make tray icons themed under some desktop environments like KDE plasma'
    
      20)
    
      21options=('!strip')
    
      22
    
      23# https://www.dropbox.com/scl/fo/0eu2dsn07fy5k0gt5fy74/AABbXqKHbY_mobVJhqgfOXYja/Glyph/Dropbox/SVG/DropboxGlyph_Blue.svg
    
      24source=("DropboxGlyph_Blue.svg"
    
      25        "terms.txt"
    
      26        "dropbox.service"
    
      27        "dropbox@.service"
    
      28        "https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-$pkgver.tar.gz"{,.asc})
    
      29
    
      30sha256sums=('9ba76205ec5838db85d822f23cfd7e2112fd2757e8031d8374709f102143c548'
    
      31            '1610ff57e8b20ee7a37682c3cc505da4ddc9cec2bd7234c90c0f2073657521d2'
    
      32            '6c67a9c8c95c08fafafd2f1d828074b13e3347b05d2e4f4bf4e62746115d7477'
    
      33            '98581e65a91ae1f19ed42edcdaaa52e102298b5da0d71b50089393d364474d3d'
    
      34            'bf0b0945ace2c02fe790189fece8a2fa9c3a9c7e9fef879eb34b01098a957a01'
    
      35            'SKIP')
    
      36# The PGP key fingerprint should match the one on https://www.dropbox.com/help/desktop-web/linux-commands
    
      37validpgpkeys=(
    
      38  '1C61A2656FB57B7E4DE0F4C1FC918B335044912E'  # Dropbox Automatic Signing Key <linux@dropbox.com>
    
      39)
    
      40
    
      41prepare() {
    
      42  gendesk --pkgname="$pkgname" --pkgdesc="$pkgdesc" --categories=Network -f PKGBUILD
    
      43}
    
      44
    
      45package() {
    
      46  install -d "$pkgdir"/opt
    
      47  cp -dr --no-preserve=ownership "$srcdir"/.dropbox-dist/dropbox-lnx.x86_64-$pkgver "$pkgdir"/opt/dropbox
    
      48  chmod 755 "$pkgdir"/opt/dropbox/*.so
    
      49
    
      50  install -d "$pkgdir"/usr/bin
    
      51  ln -s ../../opt/dropbox/dropbox "$pkgdir"/usr/bin/dropbox
    
      52
    
      53  install -Dm644 "$srcdir"/dropbox.desktop -t "$pkgdir"/usr/share/applications
    
      54  install -Dm644 "$srcdir"/DropboxGlyph_Blue.svg "$pkgdir"/usr/share/pixmaps/dropbox.svg
    
      55  install -Dm644 "$srcdir"/terms.txt -t "$pkgdir"/usr/share/licenses/$pkgname
    
      56  install -Dm644 "$srcdir"/dropbox.service -t "$pkgdir"/usr/lib/systemd/user
    
      57  install -Dm644 "$srcdir"/dropbox@.service -t "$pkgdir"/usr/lib/systemd/system
    
      58}
    
      59
    
      60pkgrel=2
    
      61install="$pkgname.install"
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 01:22:29	Medium	3
2026-10-14 01:18:27	Medium	2