imvu

LOW

maintainer karlthegamer101 0 votes scanned 2026-10-28 07:51:26.186995

View on AUR

Why flagged

The two Windows executables are downloaded from IMVU's own official infrastructure (static-akm.imvu.com and electron-client.imvu.com) with explicit SHA-256 checksums, and they are installed as data files under /usr/share/imvu rather than executed at build time; the wrapper scripts (imvu-classic, imvu-desktop, etc.) are local bundled files whose checksums are also verified, so there is no unverifiable remote code execution, just a Wine-based packaging of official IMVU installers.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The two Windows executables are downloaded from IMVU's own official infrastructure (static-akm.imvu.com and electron-client.imvu.com) with explicit SHA-256 checksums, and they are installed as data files under /usr/share/imvu rather than executed at build time; the wrapper scripts (imvu-classic, imvu-desktop, etc.) are local bundled files whose checksums are also verified, so there is no unverifiable remote code execution, just a Wine-based packaging of official IMVU installers.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "InstallIMVU_554.8.exe::https://static-akm.imvu.com/imvufiles/installers/InstallIMVU_554.8.exe"
PKGBUILD:13 "IMVUApp-BETA-15.6.1.exe::https://electron-client.imvu.com/electron-client/win32/15.6.1/IMVUApp-BETA-15.6.1.exe"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Your Name <your@email.com>
    
      2pkgname=imvu
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="IMVU Classic and IMVU Desktop clients via Wine"
    
      6arch=('x86_64')
    
      7url="https://www.imvu.com/"
    
      8license=('custom')
    
      9depends=('wine' 'wine-gecko' 'wine-mono' 'desktop-file-utils')
    
      10optdepends=('winetricks: for extra DLL/runtime fixes')
    
      11source=(
    
      12  "InstallIMVU_554.8.exe::https://static-akm.imvu.com/imvufiles/installers/InstallIMVU_554.8.exe"
    
      13  "IMVUApp-BETA-15.6.1.exe::https://electron-client.imvu.com/electron-client/win32/15.6.1/IMVUApp-BETA-15.6.1.exe"
    
      14  "imvu-classic"
    
      15  "imvu-classic-setup"
    
      16  "imvu-desktop"
    
      17  "imvu-desktop-setup"
    
      18  "imvu-classic.desktop"
    
      19  "imvu-desktop.desktop"
    
      20)
    
      21sha256sums=(
    
      22  '1d4202099d75b1c0a031e28ebcbfa81cb78b296244972ab84b3b779d7d5fb731'
    
      23  '0cc610973780d07481977504be67d8388eff33a3feab0eb14fb25504ad06f684'
    
      24  '6f08a830d80e63325efc13fa5924f4538d19c3caca2a4032fa3a75e955fb384b'
    
      25  '8f921467359063c33496e952f2e0d3ad3d25dda9529bfcaca15b07b75cbd2699'
    
      26  '988dbbbe0fbad22c04aa9aa0cb8c232579650b377df5b47f2463652010ec1105'
    
      27  '88116c6d6f598d0d275b00416ac08469fc638ab51eb73b70a6f1d84542e8ffc1'
    
      28  '445e5af83cb4fc207ecf3aa26ddd540a7968ee72212b11d6d6bc922707270787'
    
      29  '09cf6cd331cbcd2c3612db90744d56dde5a91b21598cce499cbc1ea236ee281b'
    
      30)
    
      31
    
      32package() {
    
      33  install -dm755 "$pkgdir/usr/share/imvu"
    
      34  install -Dm644 "$srcdir/InstallIMVU_554.8.exe" "$pkgdir/usr/share/imvu/"
    
      35  install -Dm644 "$srcdir/IMVUApp-BETA-15.6.1.exe" "$pkgdir/usr/share/imvu/"
    
      36
    
      37  install -Dm755 "$srcdir/imvu-classic" "$pkgdir/usr/bin/imvu-classic"
    
      38  install -Dm755 "$srcdir/imvu-classic-setup" "$pkgdir/usr/bin/imvu-classic-setup"
    
      39  install -Dm755 "$srcdir/imvu-desktop" "$pkgdir/usr/bin/imvu-desktop"
    
      40  install -Dm755 "$srcdir/imvu-desktop-setup" "$pkgdir/usr/bin/imvu-desktop-setup"
    
      41
    
      42  install -Dm644 "$srcdir/imvu-classic.desktop" "$pkgdir/usr/share/applications/imvu-classic.desktop"
    
      43  install -Dm644 "$srcdir/imvu-desktop.desktop" "$pkgdir/usr/share/applications/imvu-desktop.desktop"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-28 07:51:26	Low	3
2026-10-28 07:49:59	Medium	2