freebuff-bin

HIGH

maintainer lapsus 1 votes scanned 2026-08-21 13:15:20.063848

View on AUR

Why flagged

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

Triggered rules

High Remote download executed by a shell curl_pipe_shell

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

PKGBUILD:21 curl -fsSL 'https://registry.npmjs.org/freebuff/latest' | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])"

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/freebuff-linux-x64.tar.gz")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2pkgname=freebuff-bin
    
      3pkgver=0.0.150
    
      4pkgrel=1
    
      5pkgdesc='Free AI coding agent for the terminal, by Codebuff'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://freebuff.com'
    
      8license=('Apache-2.0')
    
      9depends=('glibc')
    
      10provides=('freebuff')
    
      11conflicts=('freebuff')
    
      12options=('!strip' '!debug')
    
      13
    
      14source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/freebuff-linux-x64.tar.gz")
    
      15sha256sums_x86_64=('97683101be6f02db594bff32737eb671d0d8538236ed25e951ea8432d1250884')
    
      16sha256sums_aarch64=('dcc046715f8f9ea94ccad216bddef448415a226cc4549ed483eff1948bd7bce0')
    
      17
    
      18source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/freebuff-linux-arm64.tar.gz")
    
      19
    
      20latestver() {
    
      21    curl -fsSL 'https://registry.npmjs.org/freebuff/latest' | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])"
    
      22}
    
      23
    
      24pkgver() {
    
      25    latestver
    
      26}
    
      27
    
      28package() {
    
      29    install -Dm755 freebuff "${pkgdir}/usr/lib/freebuff/freebuff"
    
      30    install -Dm644 tree-sitter.wasm "${pkgdir}/usr/lib/freebuff/tree-sitter.wasm"
    
      31    install -d "${pkgdir}/usr/bin"
    
      32    ln -s ../lib/freebuff/freebuff "${pkgdir}/usr/bin/freebuff"
    
      33}
    
      34

Changes since previous scan

--- PKGBUILD @ 2026-08-13 09:28
+++ PKGBUILD @ 2026-08-21 13:15
@@ -1,6 +1,6 @@
 # Maintainer: Yakov Till <yakov.till@gmail.com>
 pkgname=freebuff-bin
-pkgver=0.0.148
+pkgver=0.0.150
 pkgrel=1
 pkgdesc='Free AI coding agent for the terminal, by Codebuff'
 arch=('x86_64' 'aarch64')
@@ -12,8 +12,8 @@
 options=('!strip' '!debug')
 
 source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/freebuff-linux-x64.tar.gz")
-sha256sums_x86_64=('aab2882138ab9a658ed6749e586aa4440ac0a645f94f3f3e3ff6a003ffb44e7e')
-sha256sums_aarch64=('066aa364d3a8d487a7668d2dc962c607083c8fee8339cf05a8d809adc41cae4d')
+sha256sums_x86_64=('97683101be6f02db594bff32737eb671d0d8538236ed25e951ea8432d1250884')
+sha256sums_aarch64=('dcc046715f8f9ea94ccad216bddef448415a226cc4549ed483eff1948bd7bce0')
 
 source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://codebuff.com/api/releases/download/${pkgver}/freebuff-linux-arm64.tar.gz")
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-21 13:15:20	High	2
2026-08-18 15:41:58	Clean	3
2026-08-18 15:40:04	High	2
2026-08-13 09:28:59	Clean	3
2026-08-13 09:26:10	High	2
2026-08-13 07:28:52	Clean	3
2026-08-13 07:25:43	High	2
2026-08-13 01:25:20	High	2
2026-08-12 15:27:06	Clean	3
2026-08-12 15:24:23	High	2
2026-08-12 01:25:24	Clean	3
2026-08-12 01:22:13	High	2
2026-08-11 17:34:14	Clean	3
2026-08-11 17:21:34	High	2
2026-08-01 00:11:18	Clean	3
2026-07-31 17:18:23	High	2
2026-07-31 13:20:15	Clean	3
2026-07-31 13:18:10	High	2
2026-07-30 23:19:23	Clean	3
2026-07-30 23:17:02	High	2