endcord-gui

MEDIUM

maintainer sparklost 0 votes scanned 2026-09-21 05:34:06.811684

View on AUR

Why flagged

The package downloads a prebuilt binary from a GitHub release on a non-whitelisted host with an unverifiable 'SKIP' checksum, creating a supply-chain risk if the source were tampered with.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package downloads a prebuilt binary from a GitHub release on a non-whitelisted host with an unverifiable 'SKIP' checksum, creating a supply-chain risk if the source were tampered with.

PKGBUILD

      1# Maintainer: Marko Zivic <marko.b.zivic@gmail.com>
    
      2pkgname=endcord-gui
    
      3pkgver=1.5.4
    
      4pkgrel=1
    
      5pkgdesc="Feature rich Discord 'TUI' client. Windowed 'GUI' version using GTK3."
    
      6arch=('x86_64')
    
      7url="https://github.com/sparklost/$pkgname"
    
      8license=('LicenseRef-SparkLost')
    
      9provides=('endcord-gui')
    
      10conflicts=('endcord-gui')
    
      11depends=('gtk3')
    
      12makedepends=()
    
      13optdepends=('xclip: clipboard support on X11'
    
      14            'wl-clipboard: clipboard support on Wayland'
    
      15            'aspell: spellchecking'
    
      16            'yt-dlp: youtube support'
    
      17            'mpv: youtube in native player')
    
      18source=("$pkgname-$pkgver.tar.gz::$url/releases/download/$pkgver/$pkgname-$pkgver-linux.tar.gz")
    
      19sha256sums=('SKIP')
    
      20options=(!strip)
    
      21
    
      22package() {
    
      23	install -Dm755 ./$pkgname "$pkgdir/usr/bin/$pkgname"
    
      24	install -Dm644 ./README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      25	install -Dm644 ./docs/commands.md "$pkgdir/usr/share/doc/endcord/commands.md"
    
      26	install -Dm644 ./docs/configuration.md "$pkgdir/usr/share/doc/endcord/configuration.md"
    
      27	install -Dm644 ./docs/extensions.md "$pkgdir/usr/share/doc/endcord/extensions.md"
    
      28	install -Dm644 ./docs/keybindings.md "$pkgdir/usr/share/doc/endcord/keybindings.md"
    
      29	install -Dm644 ./LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      30    install -Dm644 ./$pkgname.desktop "$pkgdir/usr/share/applications/com.sparklost.$pkgname.desktop"
    
      31    install -Dm644 ./$pkgname.svg "$pkgdir/usr/share/icons/hicolor/256x256/apps/com.sparklost.$pkgname.svg"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-21 05:34:06	Medium	2