hyphen-sv
LOW
maintainer VorpalWay
10 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a dictionary file from LibreOffice's official extensions site; the file is non-executable data used for hyphenation, so even if the host were compromised, the risk is limited to data tampering, not code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a dictionary file from LibreOffice's official extensions site; the file is non-executable data used for hyphenation, so even if the host were compromised, the risk is limited to data tampering, not code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("https://extensions.libreoffice.org/assets/downloads/z/hyph-sv.oxt")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Arvid Norlander <VorpalBlade (at) users DOT noreply DOT github DOT com>
2
# Contributor: jtts
3
# From hunspell-sv-se:
4
# Contributor: Oscar Carlsson <oscar.carlsson (at) gmail.com>
5
6
pkgname=hyphen-sv
7
pkgver=1.11
8
_pkgver=1.11
9
pkgrel=1
10
epoch=1
11
pkgdesc="Swedish hyphenation"
12
arch=('any')
13
url="https://extensions.libreoffice.org/en/extensions/show/swedish-hyphenation"
14
license=('MPL-2.0' 'LGPL-3.0-or-later')
15
depends=('hyphen')
16
source=("https://extensions.libreoffice.org/assets/downloads/z/hyph-sv.oxt")
17
sha256sums=('3542045cc924a21d8b690a569e397b5d3108895e21eae6b09c7c0683d3867a6a')
18
19
package() {
20
cd $srcdir
21
install -dm755 $pkgdir/usr/share/hyphen
22
install -D -m644 hyph_sv.dic $pkgdir/usr/share/hyphen/hyph_sv.dic
23
install -D -m644 README_hyph_sv.txt $pkgdir/usr/share/licenses/hyphen-sv/README_hyph_sv.txt
24
25
pushd $pkgdir/usr/share/hyphen/
26
ln -s hyph_sv.dic hyph_sv_SE.dic
27
ln -s hyph_sv.dic hyph_sv_FI.dic
28
popd
29
30
install -dm755 $pkgdir/usr/share/myspell/dicts
31
pushd $pkgdir/usr/share/myspell/dicts
32
ln -sv /usr/share/hyphen/hyph_sv.dic .
33
ln -sv /usr/share/hyphen/hyph_sv_SE.dic .
34
ln -sv /usr/share/hyphen/hyph_sv_FI.dic .
35
popd
36
}
37
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |