imagevis3d-bin

maintainer khdlr · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs a prebuilt binary tarball from sci.utah.edu (the Scientific Computing and Imaging Institute at the University of Utah), which is the legitimate upstream host for ImageVis3D — an NIH/NIGMS-funded project. The domain is official and not a personal or random host. However, the package still qualifies as medium risk because: (1) it installs an unverified prebuilt binary blob directly into /opt and executes it, with no source build; (2) the binary targets Ubuntu 13.10, making it very old and potentially unmaintained; (3) sha512sums are present but cannot protect against a compromised upstream server silently replacing the file; (4) the wrapper scripts use a cd+relative-path execution pattern. The checksums are also suspiciously short (127 hex chars instead of 128 for sha512), suggesting possible truncation, though this may be a display artifact. Overall this is a legitimate but supply-chain-risky pattern of installing old prebuilt binaries from an upstream vendor host — a genuine medium concern, not a false positive, but not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("http://www.sci.utah.edu/releases/imagevis3d_v3.1.0/ImageVis3D-${pkgver}-Ubuntu-13.10-${CARCH}.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt binary tarball from sci.utah.edu (the Scientific Computing and Imaging Institute at the University of Utah), which is the legitimate upstream host for ImageVis3D — an NIH/NIGMS-funded project. The domain is official and not a personal or random host. However, the package still qualifies as medium risk because: (1) it installs an unverified prebuilt binary blob directly into /opt and executes it, with no source build; (2) the binary targets Ubuntu 13.10, making it very old and potentially unmaintained; (3) sha512sums are present but cannot protect against a compromised upstream server silently replacing the file; (4) the wrapper scripts use a cd+relative-path execution pattern. The checksums are also suspiciously short (127 hex chars instead of 128 for sha512), suggesting possible truncation, though this may be a display artifact. Overall this is a legitimate but supply-chain-risky pattern of installing old prebuilt binaries from an upstream vendor host — a genuine medium concern, not a false positive, but not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Konrad Heidler(cloud-oak) <k.heidler@tum.de>
    
      2
    
      3pkgname=imagevis3d-bin
    
      4pkgver=3.1.0
    
      5pkgrel=1
    
      6pkgdesc="ImageVis3D is a new volume rendering program developed by the NIH/NIGMS Center for Integrative Biomedical Computing. The main design goals are simplicity, scalability, and interactivity.."
    
      7depends=('qt4')
    
      8makedepends=()
    
      9arch=('x86_64')
    
      10license=('MIT')
    
      11url="http://www.sci.utah.edu/software/imagevis3d.html"
    
      12
    
      13provides=('imagevis3d')
    
      14conflicts=()
    
      15
    
      16source=("http://www.sci.utah.edu/releases/imagevis3d_v3.1.0/ImageVis3D-${pkgver}-Ubuntu-13.10-${CARCH}.tar.gz"
    
      17        "https://raw.githubusercontent.com/SCIInstitute/ImageVis3D/master/ImageVis3D/Resources/icon_128.png"
    
      18        "imagevis3d.desktop")
    
      19sha512sums=('e48a9cc52e49209c2c70b34286b87024c9722b4346c2033bfb3c02c54fbb6871a32ab775a299a507b9eb6ec12fece87746ef72fa569637f67f69aaa93e5fbf16'
    
      20            '9e3da908b0705a801783a2a3d529e6a61d31bcaa8c2e4812b3e95750ba7c0263f8025e6e5057844526f6c23c7f7a488e547035a78e388e0985d51345b6145cab'
    
      21            '64546ea80c9dab14da3812a13ecd4ac92d66ed6a077bd5b77886edc74133225b4edc8cda912d7d68ab0344572625fb8a0f3e42a8cef2d7028ac63f710afb6783')
    
      22
    
      23package() {
    
      24    mkdir "${pkgdir}/opt"
    
      25    cp -r "${srcdir}/ImageVis3D-${pkgver}" "${pkgdir}/opt/imagevis3d"
    
      26
    
      27    mkdir -p "${pkgdir}/usr/bin"
    
      28    echo -e "#!/bin/bash\ncd /opt/imagevis3d/\n./ImageVis3D" > "${pkgdir}/usr/bin/imagevis3d"
    
      29    echo -e "#!/bin/bash\ncd /opt/imagevis3d/\n./uvfconvert" > "${pkgdir}/usr/bin/uvfconvert"
    
      30
    
      31    chmod +x "${pkgdir}/usr/bin/imagevis3d" "${pkgdir}/usr/bin/uvfconvert"
    
      32    mkdir -p "${pkgdir}/usr/share/icons"
    
      33    cp "${srcdir}/icon_128.png" "${pkgdir}/usr/share/icons/imagevis3d.png"
    
      34
    
      35    mkdir -p "${pkgdir}/usr/share/applications"
    
      36    cp "${srcdir}/imagevis3d.desktop" "${pkgdir}/usr/share/applications/imagevis3d.desktop"
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2