hyphen-sv
LOW
maintainer VorpalWay
10 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a dictionary file from LibreOffice's official extensions site; the file is non-executable data used for hyphenation, so even if the host were compromised, the risk is limited to data tampering, not code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a dictionary file from LibreOffice's official extensions site; the file is non-executable data used for hyphenation, so even if the host were compromised, the risk is limited to data tampering, not code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("https://extensions.libreoffice.org/assets/downloads/z/hyph-sv.oxt")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Arvid Norlander <VorpalBlade (at) users DOT noreply DOT github DOT com>
2
# Contributor: jtts
3
# From hunspell-sv-se:
4
# Contributor: Oscar Carlsson <oscar.carlsson (at) gmail.com>
5
6
pkgname=hyphen-sv
7
pkgver=1.11
8
_pkgver=1.11
9
pkgrel=1
10
epoch=1
11
pkgdesc="Swedish hyphenation"
12
arch=('any')
13
url="https://extensions.libreoffice.org/en/extensions/show/swedish-hyphenation"
14
license=('MPL-2.0' 'LGPL-3.0-or-later')
15
depends=('hyphen')
16
source=("https://extensions.libreoffice.org/assets/downloads/z/hyph-sv.oxt")
17
sha256sums=('3542045cc924a21d8b690a569e397b5d3108895e21eae6b09c7c0683d3867a6a')
18
19
package() {
20
cd $srcdir
21
install -dm755 $pkgdir/usr/share/hyphen
22
install -D -m644 hyph_sv.dic $pkgdir/usr/share/hyphen/hyph_sv.dic
23
install -D -m644 README_hyph_sv.txt $pkgdir/usr/share/licenses/hyphen-sv/README_hyph_sv.txt
24
25
pushd $pkgdir/usr/share/hyphen/
26
ln -s hyph_sv.dic hyph_sv_SE.dic
27
ln -s hyph_sv.dic hyph_sv_FI.dic
28
popd
29
30
install -dm755 $pkgdir/usr/share/myspell/dicts
31
pushd $pkgdir/usr/share/myspell/dicts
32
ln -sv /usr/share/hyphen/hyph_sv.dic .
33
ln -sv /usr/share/hyphen/hyph_sv_SE.dic .
34
ln -sv /usr/share/hyphen/hyph_sv_FI.dic .
35
popd
36
}
37
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |