ftl-csv-convert-bin

maintainer MLM-stuff · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release hosted under a personal account, which is unverifiable and could be silently replaced with malicious code, posing a supply-chain risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release hosted under a personal account, which is unverifiable and could be silently replaced with malicious code, posing a supply-chain risk.

PKGBUILD

      1# Maintainer: mlm-games <125530737+mlm-games@users.noreply.github.com>
    
      2pkgname=ftl-csv-convert-bin
    
      3pkgver=0.1.2
    
      4pkgrel=1
    
      5pkgdesc='Bidirectional converter between Fluent (.ftl) locale trees and a single CSV'
    
      6arch=('x86_64')
    
      7url="https://github.com/mlm-games/ftl-csv-convert"
    
      8license=('MIT OR Apache-2.0')
    
      9depends=()
    
      10provides=(ftl-csv-convert)
    
      11conflicts=(ftl-csv-convert)
    
      12source=("${pkgname}-${pkgver}::https://github.com/mlm-games/ftl-csv-convert/releases/download/v${pkgver}/ftl-csv-convert-linux-x86_64")
    
      13sha256sums=('e8c5b35ffe315c5d41bb8612057233d40b929edff6d1fad44e13abb153a046e6')
    
      14
    
      15package() {
    
      16  install -Dm755 "${srcdir}/${pkgname}-${pkgver}" "${pkgdir}/usr/bin/ftl-csv-convert"
    
      17}
    
      18

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 05:14:03	MEDIUM	2