hterm-32

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs a prebuilt 32-bit binary (hterm) from the upstream author's personal website (der-hammer.info) without any source code build step. While sha256sums are present providing integrity checking, the binary is pulled from a personal/unofficial host rather than a well-known forge or distribution mirror. The executed binary is i686-only and depends on lib32 libraries, confirming it is a precompiled executable installed directly to /usr/bin. This is a genuine supply-chain concern: if der-hammer.info is compromised, users receive a malicious binary with no way to audit the build. The sha256 checksums mitigate substitution attacks only if the PKGBUILD itself is not also updated by an attacker. Additionally, the source version mismatch (pkgver=0.8.4 but the tarball is hterm085) is a minor inconsistency. This is a real medium-severity concern: prebuilt binary from a personal host, not clearly malicious but not verifiable.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("hterm.png" "hterm.desktop" "http://www.der-hammer.info/terminal/hterm085-linux-32.tgz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and installs a prebuilt 32-bit binary (hterm) from the upstream author's personal website (der-hammer.info) without any source code build step. While sha256sums are present providing integrity checking, the binary is pulled from a personal/unofficial host rather than a well-known forge or distribution mirror. The executed binary is i686-only and depends on lib32 libraries, confirming it is a precompiled executable installed directly to /usr/bin. This is a genuine supply-chain concern: if der-hammer.info is compromised, users receive a malicious binary with no way to audit the build. The sha256 checksums mitigate substitution attacks only if the PKGBUILD itself is not also updated by an attacker. Additionally, the source version mismatch (pkgver=0.8.4 but the tarball is hterm085) is a minor inconsistency. This is a real medium-severity concern: prebuilt binary from a personal host, not clearly malicious but not verifiable.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jaro Habiger <jarohabiger@gmail.com>
    
      2# Contributor: Robin Heinemann <robin.ole.heinemann@gmail.com>
    
      3
    
      4pkgname=hterm-32
    
      5pkgver=0.8.4
    
      6pkgrel=1
    
      7pkgdesc="HTerm serial terminal"
    
      8arch=("i686")
    
      9url="http://www.der-hammer.info/terminal"
    
      10license=(properitary)
    
      11depends=("lib32-gtk2" "lib32-libpng" "lib32-libsm")
    
      12optdepends=()
    
      13conflicts=(hterm)
    
      14
    
      15source=("hterm.png" "hterm.desktop" "http://www.der-hammer.info/terminal/hterm085-linux-32.tgz")
    
      16sha256sums=('358862a79e6a88ca07dc86faa5e29d862bbf2aa2ca16e7f43e2f00a8c444e683'  
    
      17	    'fba0a7159c9187bfe8d2c7f63611bf4c2193a69566566bca79f2ce3ff46073f7'  
    
      18	    'aaf5f1afc9b3c0aad3bd7835fea6cc3e805a680a9c4a655d1bc39acf37f2ca92')
    
      19
    
      20package() {
    
      21	install -d "$pkgdir"/usr/bin
    
      22	install -Dm755 "$srcdir"/hterm "$pkgdir"/usr/bin/hterm
    
      23	install -Dm644 "$srcdir"/hterm.desktop "$pkgdir"/usr/share/applications/hterm.desktop
    
      24	install -Dm644 "$srcdir"/hterm.png "$pkgdir"/usr/share/pixmaps/hterm.png
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2