fygram-bin

maintainer amoyrlet · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release hosted under a personal account, which is unverifiable and could be silently replaced with malicious code, posing a supply-chain risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release hosted under a personal account, which is unverifiable and could be silently replaced with malicious code, posing a supply-chain risk.

PKGBUILD

      1# Maintainer: amoyrlet <amoyrlet@proton.me>
    
      2pkgname=fygram-bin
    
      3pkgver=0.2.0
    
      4pkgrel=1
    
      5pkgdesc="Desktop music player that indexes and plays audio from your Telegram channels"
    
      6arch=('x86_64')
    
      7url="https://github.com/amoyrlet-tg/fygram"
    
      8license=('Apache-2.0')
    
      9provides=('fygram')
    
      10conflicts=('fygram')
    
      11depends=('webkit2gtk-4.1' 'gtk3' 'alsa-lib' 'openssl' 'hicolor-icon-theme')
    
      12# a prebuilt binary has nothing to strip and no sources to point a debug
    
      13# package at, so makepkg's defaults only produce a broken fygram-bin-debug
    
      14options=('!strip' '!debug')
    
      15source=("fygram-arch-installer-${pkgver}.tar.gz::https://github.com/amoyrlet-tg/fygram/releases/download/v${pkgver}/fygram-arch-installer.tar.gz")
    
      16sha256sums=('7c21d1ed8cc7a1462e3f56d4765ce3ddc097bcd8b92595867be769f0124d5c15')
    
      17
    
      18package() {
    
      19  cd "$srcdir/fygram-arch"
    
      20
    
      21  install -Dm755 fygram-arch-x86_64 "$pkgdir/usr/bin/fygram"
    
      22  install -Dm644 fygram.png "$pkgdir/usr/share/icons/hicolor/128x128/apps/fygram.png"
    
      23
    
      24  install -dm755 "$pkgdir/usr/share/applications"
    
      25  cat > "$pkgdir/usr/share/applications/fygram.desktop" <<EOF
    
      26[Desktop Entry]
    
      27Type=Application
    
      28Name=fygram
    
      29Comment=${pkgdesc}
    
      30Exec=fygram
    
      31Icon=fygram
    
      32Terminal=false
    
      33Categories=AudioVideo;Audio;Player;
    
      34StartupWMClass=fygram
    
      35EOF
    
      36  chmod 644 "$pkgdir/usr/share/applications/fygram.desktop"
    
      37}
    
      38

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: amoyrlet <amoyrlet@proton.me>
 pkgname=fygram-bin
-pkgver=0.1.0
+pkgver=0.2.0
 pkgrel=1
 pkgdesc="Desktop music player that indexes and plays audio from your Telegram channels"
 arch=('x86_64')
@@ -13,7 +13,7 @@
 # package at, so makepkg's defaults only produce a broken fygram-bin-debug
 options=('!strip' '!debug')
 source=("fygram-arch-installer-${pkgver}.tar.gz::https://github.com/amoyrlet-tg/fygram/releases/download/v${pkgver}/fygram-arch-installer.tar.gz")
-sha256sums=('945b885712f67bd6ed4ba077564dfc444478a5ef97b4283ffdfd842586ace155')
+sha256sums=('7c21d1ed8cc7a1462e3f56d4765ce3ddc097bcd8b92595867be769f0124d5c15')
 
 package() {
   cd "$srcdir/fygram-arch"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 13:38:59	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 07:27:58	MEDIUM	2
2026-07-24 00:02:28	LOW	2
2026-07-23 09:22:54	LOW	2
2026-07-23 03:22:31	MEDIUM	2