ipfs-desktop-electron-bin

MEDIUM

maintainer RubenKelevra 1 votes scanned 2026-09-06 15:12:20.220602

View on AUR

Why flagged

The package installs a prebuilt Electron binary from GitHub releases without code access, posing a supply-chain risk if the source were compromised, though it links to system dependencies and uses official project infrastructure.

Triggered rules

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs a prebuilt Electron binary from GitHub releases without code access, posing a supply-chain risk if the source were compromised, though it links to system dependencies and uses official project infrastructure.

PKGBUILD

      1# Maintainer: Asuka Minato <i at asukaminato dot eu dot org>
    
      2pkgname=ipfs-desktop-electron-bin
    
      3pkgver=0.46.0
    
      4pkgrel=1
    
      5pkgdesc="An unobtrusive and user-friendly desktop application for IPFS on Windows, Mac and Linux."
    
      6arch=(x86_64 aarch64)
    
      7url="https://ipfs.tech/"
    
      8license=('MIT')
    
      9depends=(electron bash hicolor-icon-theme go-ipfs)
    
      10source=("https://github.com/ipfs-shipyard/ipfs-desktop/releases/download/v${pkgver}/ipfs-desktop-${pkgver}-linux-amd64.deb"
    
      11	https://raw.githubusercontent.com/ipfs/ipfs-desktop/main/LICENSE
    
      12)
    
      13sha256sums=('1e8b1a339fea7db89ea298eb1d175ce814df6ced665823d2de81265477ba1610'
    
      14            '12987594680fa07203d37f691267bfea6eafc5e8b441f3c9ac7afcbda09c92ef')
    
      15options=(!emptydirs)
    
      16
    
      17package() {
    
      18	bsdtar -xvpf data.tar.* -C "$pkgdir"
    
      19	find $pkgdir/opt -type f -not -path "*/resources/*" -delete
    
      20	find $pkgdir -type f -name "ipfs" -path "*/app.asar.unpacked/*" -print -exec ln -sf /usr/bin/ipfs {} \;
    
      21
    
      22	printf '#!/bin/bash
    
      23set -eux -o pipefail
    
      24exec electron "/opt/IPFS Desktop/resources/app.asar" "$@"
    
      25' | install -vDm755 /dev/stdin "${pkgdir}/opt/IPFS Desktop/ipfs-desktop"
    
      26	install -vDm644 $srcdir/LICENSE -t $pkgdir/usr/share/licenses/$pkgname/
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-06 15:12:20	Medium	2
2026-06-18 16:11:54	Clean	0