endcord-installer

LOW

maintainer sparklost 0 votes scanned 2026-09-21 05:34:06.811684

View on AUR

Why flagged

The package downloads an installer script from the project's official GitHub repository, which is a normal practice for AUR packages; the SKIP'd checksum and untrusted host are concerns but the source is from the legitimate project maintainer, and it only installs a script without executing arbitrary remote code at build time.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads an installer script from the project's official GitHub repository, which is a normal practice for AUR packages; the SKIP'd checksum and untrusted host are concerns but the source is from the legitimate project maintainer, and it only installs a script without executing arbitrary remote code at build time.

PKGBUILD

      1# Maintainer: Marko Zivic <marko.b.zivic@gmail.com>
    
      2pkgname=endcord-installer
    
      3pkgver=1.5.4
    
      4pkgrel=1
    
      5pkgdesc="Installer script for endcord - feature rich Discord TUI client."
    
      6arch=('any')
    
      7url="https://github.com/sparklost/endcord"
    
      8license=('LicenseRef-SparkLost')
    
      9provides=('endcord-installer')
    
      10conflicts=('endcord-installer')
    
      11depends=('curl' 'bash')
    
      12makedepends=()
    
      13optdepends=('xclip: clipboard support on X11'
    
      14            'wl-clipboard: clipboard support on Wayland'
    
      15            'aspell: spellchecking'
    
      16            'yt-dlp: youtube support'
    
      17            'mpv: youtube in native player'
    
      18            'imagemagick: make notification images round'
    
      19            'gtk3: for endcord-gui'
    
      20            'libgirepository: required if building endcord-gui')
    
      21source=("install.sh::https://raw.githubusercontent.com/sparklost/endcord/main/tools/install.sh")
    
      22sha256sums=('SKIP')
    
      23
    
      24package() {
    
      25    install -Dm755 "${srcdir}/install.sh" "${pkgdir}/usr/bin/endcord-install"
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-21 05:34:06	Low	2