iloader-appimage

maintainer csf0304 · 2 votes · base iloader · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt AppImage from a GitHub release, which is an unverifiable executable binary; if the source were swapped, it could execute arbitrary code, constituting a supply-chain risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package installs a prebuilt AppImage from a GitHub release, which is an unverifiable executable binary; if the source were swapped, it could execute arbitrary code, constituting a supply-chain risk.

PKGBUILD

      1# Maintainer: csf0304 <charfsfan@outlook.com>
    
      2
    
      3pkgbase="iloader"
    
      4pkgname="iloader-appimage"
    
      5pkgver="2.2.7"
    
      6pkgrel=1
    
      7pkgdesc="User-friendly sideloader"
    
      8url="https://github.com/nab138/iloader"
    
      9arch=("x86_64")
    
      10license=("MIT")
    
      11depends=("fuse3" "hicolor-icon-theme")
    
      12conflicts=("iloader-bin")
    
      13options=("!strip" "!debug")
    
      14_appimage="iloader-linux-amd64.AppImage"
    
      15source=("$_appimage::$url/releases/download/v$pkgver/$_appimage"
    
      16  "LICENSE::$url/raw/refs/tags/v$pkgver/LICENSE")
    
      17sha256sums=('16e3f1101b612bb8adaa680cd51fb8bc229ca27c68d37c46fbdff6ad6251bb4e'
    
      18            'c6e929e3490b6475e382b4f74aaddd068deb3bf27cca2109821591e692dfcb3b')
    
      19
    
      20prepare() {
    
      21  # Extract AppImage
    
      22  chmod +x "$srcdir/$_appimage"
    
      23
    
      24  "$srcdir/$_appimage" --appimage-extract
    
      25}
    
      26
    
      27package() {
    
      28  # Install AppImage
    
      29  install -Dm755 "$srcdir/$_appimage" "$pkgdir/opt/$pkgname/$_appimage"
    
      30
    
      31  # Create a symlink for AppImage in /usr/bin/
    
      32  install -d "$pkgdir/usr/bin"
    
      33  ln -s "/opt/$pkgname/$_appimage" "$pkgdir/usr/bin/iloader"
    
      34
    
      35  # Install desktop file
    
      36  install -Dm644 "$srcdir/squashfs-root/usr/share/applications/iloader.desktop" \
    
      37    "$pkgdir/usr/share/applications/iloader.desktop"
    
      38
    
      39  # Install icons
    
      40  for path in "$srcdir"/squashfs-root/usr/share/icons/hicolor/*/apps/iloader.*; do
    
      41    install -Dm644 "$path" "$pkgdir/${path#$srcdir/squashfs-root}"
    
      42  done
    
      43
    
      44  # Install license
    
      45  install -Dm644 "$srcdir/LICENSE" \
    
      46    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,8 +1,8 @@
-# Maintainer: Spoorloos <mick.negenman@icloud.com>
+# Maintainer: csf0304 <charfsfan@outlook.com>
 
 pkgbase="iloader"
 pkgname="iloader-appimage"
-pkgver="1.1.6"
+pkgver="2.2.7"
 pkgrel=1
 pkgdesc="User-friendly sideloader"
 url="https://github.com/nab138/iloader"
@@ -13,36 +13,36 @@
 options=("!strip" "!debug")
 _appimage="iloader-linux-amd64.AppImage"
 source=("$_appimage::$url/releases/download/v$pkgver/$_appimage"
-        "LICENSE::$url/raw/refs/tags/v$pkgver/LICENSE")
-sha256sums=("2f57c5c058dd22bae1be2065c0e4614835ec35882b4f535c54a00a96cb3a878a"
-            "c6e929e3490b6475e382b4f74aaddd068deb3bf27cca2109821591e692dfcb3b")
+  "LICENSE::$url/raw/refs/tags/v$pkgver/LICENSE")
+sha256sums=('16e3f1101b612bb8adaa680cd51fb8bc229ca27c68d37c46fbdff6ad6251bb4e'
+            'c6e929e3490b6475e382b4f74aaddd068deb3bf27cca2109821591e692dfcb3b')
 
 prepare() {
-    # Extract AppImage
-    chmod +x "$srcdir/$_appimage"
+  # Extract AppImage
+  chmod +x "$srcdir/$_appimage"
 
-    "$srcdir/$_appimage" --appimage-extract
+  "$srcdir/$_appimage" --appimage-extract
 }
 
 package() {
-    # Install AppImage
-    install -Dm755 "$srcdir/$_appimage" "$pkgdir/opt/$pkgname/$_appimage"
+  # Install AppImage
+  install -Dm755 "$srcdir/$_appimage" "$pkgdir/opt/$pkgname/$_appimage"
 
-    # Create a symlink for AppImage in /usr/bin/
-    install -d "$pkgdir/usr/bin"
-    ln -s "/opt/$pkgname/$_appimage" "$pkgdir/usr/bin/iloader"
+  # Create a symlink for AppImage in /usr/bin/
+  install -d "$pkgdir/usr/bin"
+  ln -s "/opt/$pkgname/$_appimage" "$pkgdir/usr/bin/iloader"
 
-    # Install desktop file
-    install -Dm644 "$srcdir/squashfs-root/usr/share/applications/iloader.desktop" \
-        "$pkgdir/usr/share/applications/iloader.desktop"
+  # Install desktop file
+  install -Dm644 "$srcdir/squashfs-root/usr/share/applications/iloader.desktop" \
+    "$pkgdir/usr/share/applications/iloader.desktop"
 
-    # Install icons
-    for path in "$srcdir"/squashfs-root/usr/share/icons/hicolor/*/apps/iloader.*; do
-        install -Dm644 "$path" "$pkgdir/${path#$srcdir/squashfs-root}"
-    done
+  # Install icons
+  for path in "$srcdir"/squashfs-root/usr/share/icons/hicolor/*/apps/iloader.*; do
+    install -Dm644 "$path" "$pkgdir/${path#$srcdir/squashfs-root}"
+  done
 
-    # Install license
-    install -Dm644 "$srcdir/LICENSE" \
-        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  # Install license
+  install -Dm644 "$srcdir/LICENSE" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 01:31:24	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0