hangul-attack

maintainer ChaosKid42 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary directly from gobillykorean.com (a personal/commercial website, not an official distribution channel like GitHub releases or a distro mirror) and installs it as an executable at /usr/bin/hangul-attack. The sha256sum provides integrity against accidental corruption but not against a compromised host serving a malicious binary in place of the legitimate one. There is no source code, no build step, and no way to verify the binary's provenance beyond the checksum. This is a classic supply-chain risk: if the host is compromised or the file is replaced, users would execute arbitrary code. The risk is real but not evidence of active malice, placing this squarely in the medium category.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("${pkgname}::https://gobillykorean.com/shop/File/get/?file=Hangul_Attack_Linux" "${pkgname}.png::https://gobillykorean.com/wp-content/uploads/2015/12/top_sitebanner.png")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD downloads a prebuilt binary directly from gobillykorean.com (a personal/commercial website, not an official distribution channel like GitHub releases or a distro mirror) and installs it as an executable at /usr/bin/hangul-attack. The sha256sum provides integrity against accidental corruption but not against a compromised host serving a malicious binary in place of the legitimate one. There is no source code, no build step, and no way to verify the binary's provenance beyond the checksum. This is a classic supply-chain risk: if the host is compromised or the file is replaced, users would execute arbitrary code. The risk is real but not evidence of active malice, placing this squarely in the medium category.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christoph Scholz <christoph.scholz@gmail.com>
    
      2pkgname=hangul-attack
    
      3pkgver=20220121
    
      4pkgrel=1
    
      5pkgdesc="Game for practicing typing Hangul (Korean alphabet)."
    
      6arch=('any')
    
      7url="https://gobillykorean.com/free-korean-typing-game-hangul-attack-new-update-2021/"
    
      8license=('unknown')
    
      9options=("!strip")
    
      10source=("${pkgname}::https://gobillykorean.com/shop/File/get/?file=Hangul_Attack_Linux" "${pkgname}.png::https://gobillykorean.com/wp-content/uploads/2015/12/top_sitebanner.png")
    
      11sha256sums=('b5d6203aa4b1fe70a3ee9209af4917846eb8da9ba1aaf7fbf6bf1c2a2fff546f'
    
      12            '9912d75ae96e8f8fa380735ba90c6350dd60b8cbede36cc59e0abe95ba89f478')
    
      13
    
      14package() {
    
      15	install -D -m755 "${srcdir}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      16	install -D -m644 "${srcdir}/${pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      17	mkdir -p -m755 "${pkgdir}/usr/share/applications/"
    
      18	printf "[Desktop Entry]
    
      19Version=${pkgver}
    
      20Type=Application
    
      21Name=Hangul Attack
    
      22Comment=${pkgdesc}
    
      23Exec=${pkgname}
    
      24Icon=${pkgname}
    
      25Categories=Game
    
      26Terminal=false
    
      27StartupNotify=true
    
      28" >> "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2