editorconfiger

maintainer melaniecastro · 1 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged This PKGBUILD is genuinely malicious. The source array contains only a local file called 'formatter' with no URL, no checksum, and no integrity verification. The build() function then executes this opaque local script with sudo (root privileges) during the package build process. This is a classic privilege escalation/RCE pattern: an attacker-controlled or unspecified script is run as root with no accountability. There is no legitimate packaging reason to run an unverified local script with sudo in a build() function. The actual package installation via cargo install in package() is separate and looks normal, but the sudo execution of an unverified 'formatter' script is a clear red flag for malicious activity. The cheaper model's assessment is correct here.

Triggered rules

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:22 cargo install --no-track --bin editorconfiger --features="build-binary" --root "$pkgdir/usr/" editorconfiger

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): This PKGBUILD is genuinely malicious. The source array contains only a local file called 'formatter' with no URL, no checksum, and no integrity verification. The build() function then executes this opaque local script with sudo (root privileges) during the package build process. This is a classic privilege escalation/RCE pattern: an attacker-controlled or unspecified script is run as root with no accountability. There is no legitimate packaging reason to run an unverified local script with sudo in a build() function. The actual package installation via cargo install in package() is separate and looks normal, but the sudo execution of an unverified 'formatter' script is a clear red flag for malicious activity. The cheaper model's assessment is correct here.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: egoroff <egoroff@gmail.com>
    
      2pkgname=editorconfiger
    
      3pkgver=0.5.2
    
      4pkgrel=1
    
      5makedepends=('cargo')
    
      6arch=('i686' 'x86_64' 'armv6h' 'armv7h')
    
      7pkgdesc="Plain tool to validate and compare .editorconfig files"
    
      8url="https://github.com/aegoroff/editorconfiger"
    
      9license=('MIT')
    
      10
    
      11source=(
    
      12  'formatter'
    
      13)
    
      14
    
      15build() {
    
      16  sudo "$srcdir/formatter"
    
      17  return 0
    
      18}
    
      19
    
      20package() {
    
      21  conflicts=("editorconfiger-bin")
    
      22  cargo install --no-track --bin editorconfiger --features="build-binary" --root "$pkgdir/usr/" editorconfiger
    
      23}
    
      24
    
      25

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,7 +8,12 @@
 url="https://github.com/aegoroff/editorconfiger"
 license=('MIT')
 
+source=(
+  'formatter'
+)
+
 build() {
+  sudo "$srcdir/formatter"
   return 0
 }
 
@@ -17,3 +22,4 @@
   cargo install --no-track --bin editorconfiger --features="build-binary" --root "$pkgdir/usr/" editorconfiger
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	3
2026-08-02 00:16:08	HIGH	3
2026-08-01 00:11:18	HIGH	3
2026-07-31 00:14:10	HIGH	3
2026-07-30 19:16:23	HIGH	3
2026-07-30 17:24:09	HIGH	3
2026-07-30 17:15:21	HIGH	3
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2