ggjj

MEDIUM

maintainer RubenKelevra 2 votes scanned 2026-11-01 16:01:05.312492

View on AUR

Why flagged

The package downloads a prebuilt .deb from GitHub releases, which is an unverifiable binary artifact; if the host were compromised or the source silently swapped, it could execute arbitrary code during extraction, constituting a supply-chain risk.

Triggered rules

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from GitHub releases, which is an unverifiable binary artifact; if the host were compromised or the source silently swapped, it could execute arbitrary code during extraction, constituting a supply-chain risk.

PKGBUILD

      1# Maintainer: Marco33
    
      2pkgname=ggjj
    
      3pkgver=0.39.1
    
      4pkgrel=1
    
      5pkgdesc="GG - Gui for JJ"
    
      6arch=('x86_64')
    
      7url="https://github.com/gulbanana/gg"
    
      8license=('APACHE')
    
      9source=("https://github.com/gulbanana/gg/releases/download/v${pkgver}/gg_${pkgver}_amd64.deb")
    
      10sha256sums=('11c7697e7c3d97cd8068d3db7d3a3d05b2718254ec46914b4b78c5571ca33669')
    
      11
    
      12package() {
    
      13  bsdtar -zxf "$srcdir/data.tar.gz" -C "$pkgdir"
    
      14}
    
      15
    
      16

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 16:01:05	Medium	2
2026-06-18 16:11:54	Clean	0