dvb-usb-ds3103-fw

LOW

maintainer tlanfer 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a firmware file from a project-maintainer's personal domain; firmware is non-executable data installed in the standard location, so even if the host were compromised, the impact is limited to the device driver using malicious firmware, not arbitrary code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a firmware file from a project-maintainer's personal domain; firmware is non-executable data installed in the standard location, so even if the host were compromised, the impact is limited to the device driver using malicious firmware, not arbitrary code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("http://palosaari.fi/linux/v4l-dvb/firmware/M88DS3103/3.B/dvb-demod-m88ds3103.fw")

PKGBUILD

1 offending line(s) highlighted

      1# This is an example PKGBUILD file. Use this as a start to creating your own,
    
      2# and remove these comments. For more information, see 'man PKGBUILD'.
    
      3# NOTE: Please fill out the license field for your package! If it is unknown,
    
      4# then please put 'unknown'.
    
      5
    
      6# Maintainer: Your Name <youremail@domain.com>
    
      7pkgname=dvb-usb-ds3103-fw
    
      8pkgver=1.0
    
      9pkgrel=1
    
      10pkgdesc="Firmware for TechnoTrend TT-connect S2-4600"
    
      11arch=( 'any')
    
      12url="https://www.linuxtv.org/wiki/index.php/TechnoTrend_TT-connect_S2-4600"
    
      13license=('unknown')
    
      14source=("http://palosaari.fi/linux/v4l-dvb/firmware/M88DS3103/3.B/dvb-demod-m88ds3103.fw")
    
      15
    
      16package() {
    
      17	mkdir -p $pkgdir/usr/lib/firmware
    
      18	cp dvb-demod-m88ds3103.fw $pkgdir/usr/lib/firmware
    
      19}
    
      20md5sums=('b31080dd205ce1659ed7aedf2b153e03')
    
      21

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2