gnu-netcat-bin

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 88%): The build() function executes 'sudo "$srcdir/formatter"' - running an unverified local script (listed as a source file with no meaningful integrity check beyond a sha256sum that could be anything) with root privileges via sudo. This is a serious red flag: legitimate PKGBUILDs never need sudo inside build(); makepkg already handles privilege separation. The 'formatter' file is a second source with an opaque name and unknown content - it could be anything. Running arbitrary local scripts as root during a package build is a classic malware delivery pattern. The sha256sum for the main tarball also appears truncated/incorrect (only 63 hex chars instead of 64), suggesting the PKGBUILD is carelessly or deliberately crafted. Even if 'formatter' were benign in this instance, the pattern of sudo-executing an opaque script during build() is unambiguously malicious design.