freshgram-bin

MEDIUM

maintainer Snowy-Fluffy 1 votes scanned 2026-10-19 01:23:43.518710

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release hosted on a personal account, which is unverifiable and could be silently swapped with malicious code, representing a supply-chain risk despite the project being a known fork.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt binary from a GitHub release hosted on a personal account, which is unverifiable and could be silently swapped with malicious code, representing a supply-chain risk despite the project being a known fork.

PKGBUILD

      1# Maintainer: Snowy-Fluffy <snowy.lnnk@gmail.com>
    
      2
    
      3pkgname=freshgram-bin
    
      4pkgver=7.5.0
    
      5pkgrel=1
    
      6pkgdesc='Breaking ToS Telegram Desktop fork with a lot of security features, all AyuGram features, and a lot of design styles (prebuilt)'
    
      7arch=('x86_64')
    
      8url='https://github.com/Snowy-Fluffy/freshGram'
    
      9license=('GPL-3.0-or-later')
    
      10depends=(
    
      11	'cairo'
    
      12	'fontconfig'
    
      13	'freetype2'
    
      14	'gcc-libs'
    
      15	'glib2'
    
      16	'glibc'
    
      17	'hicolor-icon-theme'
    
      18	'libx11'
    
      19	'libxcb'
    
      20	'pango'
    
      21)
    
      22optdepends=('xdg-desktop-portal: file dialogs and screen sharing')
    
      23provides=("freshgram=$pkgver")
    
      24conflicts=('freshgram' 'freshgram-git')
    
      25options=('!strip' '!debug')
    
      26source=("freshGram-linux-x86_64-$pkgver.tar.gz::$url/releases/download/v$pkgver/freshGram-linux-x86_64.tar.gz"
    
      27        "LICENSE-$pkgver::https://raw.githubusercontent.com/Snowy-Fluffy/freshGram/v$pkgver/LICENSE")
    
      28noextract=("freshGram-linux-x86_64-$pkgver.tar.gz")
    
      29sha256sums=('9fc2ba9627e7776fad2d4f1c6f5289f50076979607ac871ffcf75beb6864ba31'
    
      30            'a728b65d02eeaf6b50c075a33b76107c652c3e5a12ff67f53682c83d47a23e1e')
    
      31
    
      32package() {
    
      33	bsdtar -xf "$srcdir/freshGram-linux-x86_64-$pkgver.tar.gz" --no-same-owner -C "$pkgdir"
    
      34	install -Dm644 "$srcdir/LICENSE-$pkgver" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 01:23:43	Medium	2