habboon-client-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source_x86_64=("https://app.habboon.pw/habboon_1.0.12_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt Electron/Chromium-based binary .deb from app.habboon.pw, which is the maintainer's own personal/project host rather than an established distribution channel (GitHub releases, official CDN, etc.). The binary is executed directly on the user's system. While a sha512 checksum is present, it cannot be independently verified against any upstream source listing, meaning if the host is compromised or the file is swapped, the checksum in the PKGBUILD would need to be updated to reflect the attack — but the current checksum only protects against accidental corruption, not a deliberate host-side substitution if the attacker also controls the PKGBUILD. The application appears to be a Habbo Hotel private-server client (Habboon), which is a niche community project. The maintainer email matches the domain, suggesting this is a self-hosted release by the developer, which is a common but non-ideal AUR pattern. The real concern is an Electron binary from a single personal host with no reproducibility or independent verification path — a genuine medium supply-chain risk, not a false positive.