foobar2000-component-uie-console-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("${_fooname}-${pkgver}-${pkgrel}.fb2k-component::https://yuo.be/static/${_buildhash}/${_fooname}-${pkgver}.fb2k-component")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The .fb2k-component file is downloaded from yuo.be, a personal/unofficial host rather than the official foobar2000.org component repository or the component author's own GitHub/official release page. A .fb2k-component is a ZIP-like archive containing a DLL that gets executed inside foobar2000, so this is effectively an executed binary from an unofficial host. The sha256sum provides some integrity protection, but the source host is not the canonical upstream (foobar2000.org lists the component but the download comes from a third-party domain). This is a genuine supply-chain concern: if yuo.be is compromised or the file is swapped, users would execute a malicious DLL inside foobar2000. The PKGBUILD also has a minor issue: it installs '$srcdir/${_fooname}.dll' but the source file is named '${_fooname}-${pkgver}-${pkgrel}.fb2k-component', so the package is likely broken (no extraction step to produce the .dll). Despite the broken install logic, the supply-chain risk from the unofficial binary host remains a real medium-severity concern.