insync-thunar

MEDIUM

maintainer yurikoles 13 votes scanned 2026-10-16 00:12:47.406154

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted host (insync.io), which is not inherently malicious but presents a supply-chain risk if the host were compromised or the download redirected; however, the source is from the official vendor's domain and installs only integration scripts, limiting impact.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://apt.insync.io/ubuntu/pool/contrib/i/${pkgname}/${pkgname}_${pkgver}_all.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (insync.io), which is not inherently malicious but presents a supply-chain risk if the host were compromised or the download redirected; however, the source is from the official vendor's domain and installs only integration scripts, limiting impact.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yurii Kolesnykov <root@yurikoles.com>
    
      2# Previous maintainer: Yochai Gal <yochai gal at gmail dot com>
    
      3
    
      4pkgname=insync-thunar
    
      5pkgver=3.9.5.60024
    
      6pkgrel=1
    
      7pkgdesc="Thunar integration for insync"
    
      8url="https://www.insynchq.com/downloads"
    
      9license=('custom:insync')
    
      10options=(!strip)
    
      11arch=('any')
    
      12depends=(
    
      13	'insync'
    
      14	'thunar'
    
      15	'thunarx-python'
    
      16)
    
      17source=("https://apt.insync.io/ubuntu/pool/contrib/i/${pkgname}/${pkgname}_${pkgver}_all.deb")
    
      18sha256sums=('9c029ce467bf76c87c8d5e28529701a67c80ad3c15c18ada3acf79c5ce376d03')
    
      19
    
      20package() {
    
      21   tar xf data.tar.gz
    
      22   cp -a usr "${pkgdir}"
    
      23}
    
      24

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:03
+++ PKGBUILD @ 2026-10-16 00:12
@@ -2,7 +2,7 @@
 # Previous maintainer: Yochai Gal <yochai gal at gmail dot com>
 
 pkgname=insync-thunar
-pkgver=3.7.9.50368
+pkgver=3.9.5.60024
 pkgrel=1
 pkgdesc="Thunar integration for insync"
 url="https://www.insynchq.com/downloads"
@@ -15,7 +15,7 @@
 	'thunarx-python'
 )
 source=("https://apt.insync.io/ubuntu/pool/contrib/i/${pkgname}/${pkgname}_${pkgver}_all.deb")
-sha256sums=('5fbd42bbd6ac714bcb9a9495c1fa0873e8cbfe7f58fc15ee5aa45dc625174159')
+sha256sums=('9c029ce467bf76c87c8d5e28529701a67c80ad3c15c18ada3acf79c5ce376d03')
 
 package() {
    tar xf data.tar.gz

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 05:12:20	Medium	2
2026-06-20 16:03:41	Clean	2
2026-06-20 00:50:07	Medium	2
2026-06-20 00:18:46	Medium	1
2026-06-19 23:51:18	Medium	2
2026-06-19 19:07:35	Low	2
2026-06-18 16:11:54	Medium	1