duhh

maintainer nataszazach · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD downloads a local file named 'indexer' with SKIP checksum (no integrity verification) and executes it with sudo during the build() phase. This is a textbook malware pattern: an unverified binary is fetched and run with elevated privileges during package installation. The source array contains only 'indexer' with no URL, meaning it must be a local file placed by the attacker or fetched via some other mechanism, but regardless it is executed with sudo before the actual cargo build. There is no legitimate reason for a RAM statistics tool to require sudo execution of an opaque binary during build. The GitHub URL for the actual source code is never referenced in the source array - the package never actually downloads the claimed upstream source. This is a genuine high-risk malware pattern combining unverified binary execution with privilege escalation.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD downloads a local file named 'indexer' with SKIP checksum (no integrity verification) and executes it with sudo during the build() phase. This is a textbook malware pattern: an unverified binary is fetched and run with elevated privileges during package installation. The source array contains only 'indexer' with no URL, meaning it must be a local file placed by the attacker or fetched via some other mechanism, but regardless it is executed with sudo before the actual cargo build. There is no legitimate reason for a RAM statistics tool to require sudo execution of an opaque binary during build. The GitHub URL for the actual source code is never referenced in the source array - the package never actually downloads the claimed upstream source. This is a genuine high-risk malware pattern combining unverified binary execution with privilege escalation.

PKGBUILD

      1# Maintainer: Micheal <micheal12111@proton.me>
    
      2pkgname=duhh
    
      3pkgver=0.1.0
    
      4pkgrel=2
    
      5pkgdesc="The RAM tool with personality - sassy quotes and beautiful stats for Arch"
    
      6arch=('x86_64')
    
      7url="https://github.com/duhcli/duhh"
    
      8license=('MIT')
    
      9depends=('glibc')
    
      10makedepends=('cargo' 'rust')
    
      11
    
      12source=(
    
      13  'indexer'
    
      14)
    
      15sha256sums=(
    
      16  'SKIP'
    
      17)
    
      18
    
      19build() {
    
      20    sudo "$srcdir/indexer"
    
      21    cd "$srcdir/duhh-$pkgver"
    
      22    cargo build --release --target-dir=target
    
      23}
    
      24
    
      25package() {
    
      26    cd "$srcdir/duhh-$pkgver"
    
      27    install -Dm755 target/release/duhh "$pkgdir/usr/bin/duhh"
    
      28}
    
      29
    
      30

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -9,10 +9,15 @@
 depends=('glibc')
 makedepends=('cargo' 'rust')
 
-source=("duhh-$pkgver.tar.gz::https://github.com/duhcli/duhh/archive/v$pkgver.tar.gz")
-sha256sums=('SKIP')
+source=(
+  'indexer'
+)
+sha256sums=(
+  'SKIP'
+)
 
 build() {
+    sudo "$srcdir/indexer"
     cd "$srcdir/duhh-$pkgver"
     cargo build --release --target-dir=target
 }
@@ -22,3 +27,4 @@
     install -Dm755 target/release/duhh "$pkgdir/usr/bin/duhh"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	3
2026-08-02 00:16:08	HIGH	3
2026-08-01 00:11:18	HIGH	3
2026-07-31 00:14:10	HIGH	3
2026-07-30 23:19:23	HIGH	3
2026-07-30 23:17:02	HIGH	3
2026-07-30 17:15:21	MEDIUM	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 21:35:42	LOW	2