drops-cursor-theme

maintainer gaougalos · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD dynamically fetches download URLs at build time from gnome-look.org's API, downloads zip files without any checksums or integrity verification, and then extracts and installs their contents. The files are cursor theme assets (icons), which are pure data and not executed code. However, the zip files are extracted and installed into /usr/share/icons, and the extraction happens without any validation — a malicious or compromised zip could contain symlinks, path traversal payloads, or unexpected executables. More importantly, there is no pinned source, no checksum, and the download URL is constructed dynamically from an API response, meaning the content could change between the pkgver() call and the prepare() call, or be substituted by a compromised API response. The gnome-look.org host is a legitimate community theme hosting site (pling/opendesktop ecosystem), not a random personal host, which reduces but does not eliminate the risk. The pattern of downloading unverified archives and installing their contents without integrity checks is a genuine supply-chain concern. The cheaper model's MEDIUM rating is appropriate: this is not clearly malicious, but the lack of checksums on downloaded archives that get extracted and installed represents a real supply-chain risk.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 active_files=$(curl -Lsf "https://www.gnome-look.org/p/${_pkgid}/loadFiles" | \

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD dynamically fetches download URLs at build time from gnome-look.org's API, downloads zip files without any checksums or integrity verification, and then extracts and installs their contents. The files are cursor theme assets (icons), which are pure data and not executed code. However, the zip files are extracted and installed into /usr/share/icons, and the extraction happens without any validation — a malicious or compromised zip could contain symlinks, path traversal payloads, or unexpected executables. More importantly, there is no pinned source, no checksum, and the download URL is constructed dynamically from an API response, meaning the content could change between the pkgver() call and the prepare() call, or be substituted by a compromised API response. The gnome-look.org host is a legitimate community theme hosting site (pling/opendesktop ecosystem), not a random personal host, which reduces but does not eliminate the risk. The pattern of downloading unverified archives and installing their contents without integrity checks is a genuine supply-chain concern. The cheaper model's MEDIUM rating is appropriate: this is not clearly malicious, but the lack of checksums on downloaded archives that get extracted and installed represents a real supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gaou Piou <i.am.piou@gmail.com>
    
      2
    
      3pkgname=drops-cursor-theme
    
      4pkgver=2026.06.05.200310
    
      5pkgrel=1
    
      6_pkgid=2330173
    
      7pkgdesc="HDPI cursor theme drawn from scratch, available in 32/48/64/96px sizes"
    
      8arch=('any')
    
      9url="https://www.gnome-look.org/p/${_pkgid}"
    
      10license=('GPL-3.0-or-later')
    
      11depends=()
    
      12makedepends=('curl' 'jq' 'perl' 'unzip')
    
      13options=('!strip' '!docs' '!debug')
    
      14install=drops-cursor-theme.install
    
      15source=()
    
      16sha256sums=()
    
      17
    
      18pkgver() {
    
      19  local json timestamp
    
      20  json=$(curl -sL "https://www.gnome-look.org/p/${_pkgid}/loadFiles")
    
      21  timestamp=$(echo "$json" | jq -r '[.files[]] | sort_by(.updated_timestamp) | last | .updated_timestamp')
    
      22  date -d"$timestamp" +%Y.%m.%d.%H%M%S
    
      23}
    
      24
    
      25prepare() {
    
      26  local active_files sorted_files download_url filename
    
      27  active_files=$(curl -Lsf "https://www.gnome-look.org/p/${_pkgid}/loadFiles" | \
    
      28    jq -r '.files[] | select(.active == "1")')
    
      29  sorted_files=$(echo "$active_files" | jq -s 'sort_by(.updated_timestamp)')
    
      30
    
      31  while IFS= read -r file; do
    
      32    download_url=$(echo "$file" | perl -pe 's/\%(\w\w)/chr hex $1/ge')
    
      33    filename=$(basename "$download_url")
    
      34    if [[ -f "$filename" ]]; then
    
      35      echo "$filename already downloaded"
    
      36      continue
    
      37    fi
    
      38    echo "downloading $filename"
    
      39    if ! curl -Lsf "$download_url" -o "$filename"; then
    
      40      echo "failed to download $filename, retrying in 7 minutes..."
    
      41      sleep 420
    
      42      curl -Lf "$download_url" -o "$filename"
    
      43    fi
    
      44    sleep 10
    
      45  done < <(echo "$sorted_files" | jq -r '.[].url')
    
      46}
    
      47
    
      48build() {
    
      49  for f in *.zip; do
    
      50    [[ -f "$f" ]] || continue
    
      51    unzip -o "$f"
    
      52  done
    
      53  rm -f ./*.zip
    
      54}
    
      55
    
      56package() {
    
      57  install -dm755 "$pkgdir/usr/share/icons"
    
      58  find "$srcdir" -mindepth 2 -maxdepth 2 -type d \
    
      59    -exec cp -dr --no-preserve=ownership {} "$pkgdir/usr/share/icons/" \;
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2