iscfpc

maintainer rarnu · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source is a prebuilt tarball fetched from a personal/unofficial host (yugioh.vip:9000) with no connection to the stated upstream (github.com/isyscore/isc-fpbase). There is no PGP signature, only an MD5 checksum (cryptographically weak). The tarball is then built with 'make install', meaning whatever compiled binary or code is inside gets executed/installed. This is a genuine supply-chain concern: the host is not an official mirror or vendor release server, the URL is opaque, and the content integrity relies solely on MD5. If the host is compromised or the tarball is swapped, arbitrary code runs on the user's system. This fits the medium severity definition: executed code from an unofficial/personal host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("http://yugioh.vip:9000/static/$pkgname-$pkgver.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The source is a prebuilt tarball fetched from a personal/unofficial host (yugioh.vip:9000) with no connection to the stated upstream (github.com/isyscore/isc-fpbase). There is no PGP signature, only an MD5 checksum (cryptographically weak). The tarball is then built with 'make install', meaning whatever compiled binary or code is inside gets executed/installed. This is a genuine supply-chain concern: the host is not an official mirror or vendor release server, the URL is opaque, and the content integrity relies solely on MD5. If the host is compromised or the tarball is swapped, arbitrary code runs on the user's system. This fits the medium severity definition: executed code from an unofficial/personal host.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=iscfpc
    
      2pkgver=1.1.0
    
      3pkgrel=22
    
      4pkgdesc="project maintain tool for FreePascal"
    
      5arch=('x86_64')
    
      6url=https://github.com/isyscore/isc-fpbase
    
      7license=('MPL')
    
      8depends=()
    
      9source=("http://yugioh.vip:9000/static/$pkgname-$pkgver.tar.gz")
    
      10noextract=()
    
      11md5sums=('df6c3b41b4a6052ab9d3abb90468db50')
    
      12validpgpkeys=()
    
      13
    
      14package() {
    
      15    cd "$srcdir"
    
      16    if [ ! -d "$pkgdir/usr/bin" ]; then
    
      17        mkdir -p "$pkgdir/usr/bin"
    
      18    fi
    
      19    make DESTDIR="$pkgdir" install
    
      20}
    
      21

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2