instawow-bin

maintainer laurabarros · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt executable from a GitHub release, which is unverifiable and from a recently orphaned and re-adopted project, posing a potential supply-chain risk if the binary was tampered with.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt executable from a GitHub release, which is unverifiable and from a recently orphaned and re-adopted project, posing a potential supply-chain risk if the binary was tampered with.

PKGBUILD

      1# Maintainer: Derek Enlow <derekenlow@gmail.com>
    
      2_pkgname="instawow"
    
      3pkgname="${_pkgname}-bin"
    
      4pkgver=7.0.0.post1
    
      5pkgrel=1
    
      6epoch=
    
      7pkgdesc="A CLI add-on manager for World of Warcraft."
    
      8arch=('x86_64')
    
      9url="https://github.com/layday/${_pkgname}"
    
      10license=('GPL')
    
      11depends=()
    
      12makedepends=("unzip")
    
      13provides=("${_pkgname}")
    
      14conflicts=("${_pkgname}")
    
      15options=()
    
      16changelog=
    
      17source=(
    
      18	"${_pkgname}-${pkgver}-LICENSE.md::https://raw.githubusercontent.com/layday/${_pkgname}/refs/tags/v${pkgver}/COPYING"
    
      19)
    
      20source_x86_64=(
    
      21	"${_pkgname}-${pkgver}-${CARCH}.zip::https://github.com/layday/instawow/releases/download/v${pkgver}/${_pkgname}-cli-${pkgver}-${CARCH}-unknown-linux-gnu.zip"
    
      22)
    
      23noextract=(
    
      24	"${_pkgname}-${pkgver}-${CARCH}.zip"
    
      25)
    
      26sha256sums=('SKIP')
    
      27sha256sums_x86_64=('6850abf948ebaf022c3c3cba337103cf2e2e8dc0a0377ba715564fc4b835dc9f')
    
      28
    
      29prepare() {
    
      30	cd "${srcdir}"
    
      31	unzip -j "${_pkgname}-${pkgver}-${CARCH}.zip"
    
      32}
    
      33
    
      34package() {
    
      35	cd "${srcdir}"
    
      36	install -vDm644 "${_pkgname}-${pkgver}-LICENSE.md" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
    
      37	install -vDm755 "${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0