hammer-dongers

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD dynamically resolves and downloads a prebuilt game binary (a Unity x86_64 executable) from itch.io at build time via a POST request and URL extraction from the response, with no checksum verification (source=() and md5sums=() are empty). This is a genuine supply-chain concern: the downloaded binary is executed by end users, and there is no integrity check whatsoever — any compromise of the itch.io endpoint, a MITM, or a change in the served file would silently deliver a different binary. The host (itch.io) is a legitimate game distribution platform, not a random personal server, which reduces but does not eliminate the risk. The pattern of dynamically constructing a download URL and skipping checksums is a well-known AUR anti-pattern for proprietary game packaging, but it is not inherently malicious. The severity remains MEDIUM due to the executed binary with no integrity verification.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:24 game_url=$(curl -s -XPOST "https://cravecraw.itch.io/hammer-dongers/file/4119554?after_download_lightbox=true" | grep -Po '"url":.*?[^\\]",' | cut -c8- | rev |cut -c3- | rev | sed 's/\\\//\//g')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD dynamically resolves and downloads a prebuilt game binary (a Unity x86_64 executable) from itch.io at build time via a POST request and URL extraction from the response, with no checksum verification (source=() and md5sums=() are empty). This is a genuine supply-chain concern: the downloaded binary is executed by end users, and there is no integrity check whatsoever — any compromise of the itch.io endpoint, a MITM, or a change in the served file would silently deliver a different binary. The host (itch.io) is a legitimate game distribution platform, not a random personal server, which reduces but does not eliminate the risk. The pattern of dynamically constructing a download URL and skipping checksums is a well-known AUR anti-pattern for proprietary game packaging, but it is not inherently malicious. The severity remains MEDIUM due to the executed binary with no integrity verification.

PKGBUILD

1 offending line(s) highlighted

      1# Mantainer: MCMic <come@chilliet.eu>
    
      2
    
      3pkgname=hammer-dongers
    
      4pkgver=0.55
    
      5pkgrel=1
    
      6pkgdesc="Up to 4 player party game with destroyable terrain!"
    
      7arch=('x86_64')
    
      8url="https://cravecraw.itch.io/hammer-dongers"
    
      9license=('nonfree')
    
      10makedepends=('unzip' 'curl' 'gendesk')
    
      11depends=()
    
      12source=()
    
      13md5sums=()
    
      14_name='Hammer Dongers'
    
      15_categories='Game;ActionGame'
    
      16
    
      17prepare() {
    
      18  gendesk -n -f ../PKGBUILD
    
      19}
    
      20
    
      21build() {
    
      22  cd ${srcdir}/
    
      23  # https://cravecraw.itch.io/hammer-dongers/data.json
    
      24  game_url=$(curl -s -XPOST "https://cravecraw.itch.io/hammer-dongers/file/4119554?after_download_lightbox=true" | grep -Po '"url":.*?[^\\]",' | cut -c8- | rev |cut -c3- | rev | sed 's/\\\//\//g')
    
      25  curl -o ${pkgname}-linux.zip ${game_url}
    
      26  unzip -o ${pkgname}-linux.zip
    
      27}
    
      28
    
      29package() {
    
      30  cd "${srcdir}/${_name} Linux - ${pkgver}"
    
      31
    
      32  mkdir -p ${pkgdir}/usr/share/games/${pkgname}
    
      33  mkdir -p ${pkgdir}/usr/bin/
    
      34  mkdir -p ${pkgdir}/usr/share/icons/hicolor/64x64/apps/
    
      35  install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      36  cp "${pkgname}-${pkgver}_Data/Resources/UnityPlayer.png" ${pkgdir}/usr/share/icons/hicolor/64x64/apps/${pkgname}.png
    
      37  cp -a . ${pkgdir}/usr/share/games/${pkgname}
    
      38  chmod +x "${pkgdir}/usr/share/games/${pkgname}/${pkgname}-${pkgver}.x86_64"
    
      39  # The game needs to be launched from the data parent directory and it needs write access to this folder
    
      40  echo -e "#!/bin/sh\ncd /usr/share/games/${pkgname}\n./\"${pkgname}-${pkgver}.x86_64\"" > ${pkgdir}/usr/bin/${pkgname}
    
      41  chmod +x ${pkgdir}/usr/bin/${pkgname}
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2