freebuff-bin

MEDIUM

maintainer lapsus 3 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package downloads prebuilt binaries from a non-whitelisted but plausibly project-owned host (codebuff.com), which could be swapped if the domain is compromised, but there is no evidence of obfuscation or remote code execution.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/freebuff-linux-x64.tar.gz")

Medium AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it MEDIUM (confidence 90%): The package downloads prebuilt binaries from a non-whitelisted but plausibly project-owned host (codebuff.com), which could be swapped if the domain is compromised, but there is no evidence of obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

High Remote download executed by a shell curl_pipe_shell

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

PKGBUILD:21 curl -fsSL 'https://registry.npmjs.org/freebuff/latest' | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2pkgname=freebuff-bin
    
      3pkgver=0.2.16
    
      4pkgrel=1
    
      5pkgdesc='Free AI coding agent for the terminal, by Codebuff'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://freebuff.com'
    
      8license=('Apache-2.0')
    
      9depends=('glibc')
    
      10provides=('freebuff')
    
      11conflicts=('freebuff')
    
      12options=('!strip' '!debug')
    
      13
    
      14source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/freebuff-linux-x64.tar.gz")
    
      15sha256sums_x86_64=('d3334b766970e615563dbfe78293818f5b7f00fa76a1d5434d1d151f4d0d04c4')
    
      16sha256sums_aarch64=('3d5e9049da25d176eedd8193aef12c1c485096c6a42d3927c3e183c38c62adc1')
    
      17
    
      18source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/freebuff-linux-arm64.tar.gz")
    
      19
    
      20latestver() {
    
      21    curl -fsSL 'https://registry.npmjs.org/freebuff/latest' | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])"
    
      22}
    
      23
    
      24pkgver() {
    
      25    latestver
    
      26}
    
      27
    
      28package() {
    
      29    install -Dm755 freebuff "${pkgdir}/usr/lib/freebuff/freebuff"
    
      30    install -Dm644 tree-sitter.wasm "${pkgdir}/usr/lib/freebuff/tree-sitter.wasm"
    
      31    install -d "${pkgdir}/usr/bin"
    
      32    ln -s ../lib/freebuff/freebuff "${pkgdir}/usr/bin/freebuff"
    
      33}
    
      34

Changes since previous scan

--- PKGBUILD @ 2026-09-28 21:24
+++ PKGBUILD @ 2026-10-06 00:13
@@ -1,6 +1,6 @@
 # Maintainer: Yakov Till <yakov.till@gmail.com>
 pkgname=freebuff-bin
-pkgver=0.1.4
+pkgver=0.2.16
 pkgrel=1
 pkgdesc='Free AI coding agent for the terminal, by Codebuff'
 arch=('x86_64' 'aarch64')
@@ -12,8 +12,8 @@
 options=('!strip' '!debug')
 
 source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/freebuff-linux-x64.tar.gz")
-sha256sums_x86_64=('02645c1354b0f72ae3ae6c138fd34b2f74afdf4552f17008713ff2f00f4af1ef')
-sha256sums_aarch64=('9f40b2b4d76cacaa1f0d598cdfe3a5534e8f3e787803c604319dee569e08d923')
+sha256sums_x86_64=('d3334b766970e615563dbfe78293818f5b7f00fa76a1d5434d1d151f4d0d04c4')
+sha256sums_aarch64=('3d5e9049da25d176eedd8193aef12c1c485096c6a42d3927c3e183c38c62adc1')
 
 source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/freebuff-linux-arm64.tar.gz")
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Medium	3
2026-10-05 23:40:58	High	2
2026-09-28 21:24:22	Clean	3
2026-09-28 21:21:47	High	2
2026-09-27 23:21:43	Clean	3
2026-09-27 23:19:54	High	2
2026-09-27 15:19:08	High	2
2026-09-27 01:18:05	Clean	3
2026-09-27 01:16:09	High	2
2026-09-26 15:16:56	Clean	3
2026-09-26 15:15:21	High	2
2026-09-26 03:15:32	Clean	3
2026-09-26 03:13:55	High	2
2026-09-25 00:03:36	Clean	3
2026-09-24 23:44:46	High	2
2026-09-24 15:46:30	Clean	3
2026-09-24 15:43:55	High	2
2026-09-23 11:42:23	Clean	3
2026-09-23 11:40:33	High	2
2026-09-23 01:39:21	High	2