head-crusher-lv2-bin

maintainer orphaned · 0 votes · base head-crusher · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs prebuilt binary plugin files (.so shared libraries for LV2 and VST3) downloaded from an S3 bucket (5db5public.s3.amazonaws.com). The S3 bucket is not the official vendor domain (audioassault.mx) — it appears to be a third-party or CDN bucket. Prebuilt .so binaries from a non-official host represent a genuine supply-chain concern: the bucket owner could replace the zip at any time, and the sha256 checksum only protects against accidental corruption or detects a swap after the fact (it does not verify the binary's provenance or signing). The installed .so files are executed in-process by audio hosts (DAWs), giving them full user-level code execution capability. This is a textbook medium: not clearly malicious, but a real concern due to executed binaries from an unofficial/personal S3 host rather than the vendor's own distribution infrastructure.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 'https://5db5public.s3.amazonaws.com/HeadCrusherLinux.zip')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt binary plugin files (.so shared libraries for LV2 and VST3) downloaded from an S3 bucket (5db5public.s3.amazonaws.com). The S3 bucket is not the official vendor domain (audioassault.mx) — it appears to be a third-party or CDN bucket. Prebuilt .so binaries from a non-official host represent a genuine supply-chain concern: the bucket owner could replace the zip at any time, and the sha256 checksum only protects against accidental corruption or detects a swap after the fact (it does not verify the binary's provenance or signing). The installed .so files are executed in-process by audio hosts (DAWs), giving them full user-level code execution capability. This is a textbook medium: not clearly malicious, but a real concern due to executed binaries from an unofficial/personal S3 host rather than the vendor's own distribution infrastructure.

PKGBUILD

1 offending line(s) highlighted

      1pkgbase=head-crusher
    
      2pkgname=('head-crusher-data-bin' 'head-crusher-lv2-bin' 'head-crusher-vst3-bin')
    
      3pkgver=1.0.2
    
      4pkgrel=1
    
      5arch=('x86_64')
    
      6url="https://audioassault.mx/plugin/Head_Crusher"
    
      7license=('EULA')
    
      8depends=('alsa-lib' 'bzip2' 'brotli' 'freetype2' 'glibc' 'graphite' 'harfbuzz' 'keyutils' 'krb5' 'libcurl-gnutls' 'libffi' 'libnghttp2' 'libidn2' 'libp11-kit' 'libpng' 'libpsl' 'libssh2' 'libtasn1' 'libunistring' 'libxau' 'libxcb' 'libx11' 'nettle' 'openssl' 'pcre2' 'zlib' 'zstd')
    
      9makedepends=('xdg-user-dirs' 'unzip')
    
      10provides=('head-crusher')
    
      11source=('Head Crusher Linker'
    
      12        'https://5db5public.s3.amazonaws.com/HeadCrusherLinux.zip')
    
      13sha256sums=('ecdcf0b394fabfd10058c41dc2993ac2c08c7916f0e2d1970620f4ff8d1c1046'
    
      14            '103bf1d707f7c7fd1ea36c641d997c701aa8785db21720b9519e7cba6f69b60b')
    
      15
    
      16package_head-crusher-data-bin() {
    
      17    ## Install Asset Data
    
      18    pkgdesc="Saturator Plugin (Data Assets)"
    
      19    groups=('pro-audio')
    
      20
    
      21    ## Make data assets dir
    
      22    mkdir -p "$pkgdir/usr/lib/5db5/Head Crusher/Presets"
    
      23
    
      24    ## Copy assets to data directory
    
      25    cp -r "$srcdir/Presets/"* "$pkgdir/usr/lib/5db5/Head Crusher/Presets"
    
      26
    
      27    ## Install Head Crusher Linker Script
    
      28    install -Dm755 "$srcdir/Head Crusher Linker" "$pkgdir/usr/bin/Head Crusher Linker"
    
      29}
    
      30
    
      31package_head-crusher-lv2-bin() {
    
      32    ## Install LV2 Plugin
    
      33    pkgdesc="Saturator Plugin (LV2)"
    
      34    depends=('head-crusher-data-bin')
    
      35    groups=('pro-audio' 'lv2-plugins')
    
      36    install -Dm755 "$srcdir/Head Crusher.lv2/Head Crusher.so" "$pkgdir/usr/lib/lv2/Head Crusher.lv2/Head Crusher.so"
    
      37    install -Dm644 "$srcdir/Head Crusher.lv2/dsp.ttl" "$pkgdir/usr/lib/lv2/Head Crusher.lv2/dsp.ttl"
    
      38    install -Dm644 "$srcdir/Head Crusher.lv2/manifest.ttl" "$pkgdir/usr/lib/lv2/Head Crusher.lv2/manifest.ttl"
    
      39    install -Dm644 "$srcdir/Head Crusher.lv2/ui.ttl" "$pkgdir/usr/lib/lv2/Head Crusher.lv2/ui.ttl"
    
      40}
    
      41
    
      42package_head-crusher-vst3-bin() {
    
      43    ## Install VST3 Plugin
    
      44    pkgdesc="Saturator Plugin (VST3)"
    
      45    depends=('head-crusher-data-bin')
    
      46    groups=('pro-audio' 'vst3-plugins')
    
      47    install -Dm755 "$srcdir/Head Crusher.vst3/Contents/Resources/moduleinfo.json" "$pkgdir/usr/lib/vst3/Head Crusher.vst3/Contents/Resources/moduleinfo.json"
    
      48    install -Dm755 "$srcdir/Head Crusher.vst3/Contents/x86_64-linux/Head Crusher.so" "$pkgdir/usr/lib/vst3/Head Crusher.vst3/Contents/x86_64-linux/Head Crusher.so"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2