iscfpcx

maintainer rarnu · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt tarball from 'yugioh.vip:9000' — a non-standard personal/unofficial host with no relation to the stated upstream (github.com/isyscore/isc-fpbase). The tarball is extracted and 'make install' is run, meaning compiled code from this unverifiable host is executed and installed into the system. There is no PGP signature, only an MD5 checksum (which provides integrity but not authenticity). The host name ('yugioh.vip') has no obvious connection to the project or its organization ('isyscore'), raising legitimate supply-chain concerns. This is a genuine medium-severity issue: executed/installed binary or compiled code sourced from an unofficial, unverifiable third-party host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("http://yugioh.vip:9000/static/$pkgname-$pkgver.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt tarball from 'yugioh.vip:9000' — a non-standard personal/unofficial host with no relation to the stated upstream (github.com/isyscore/isc-fpbase). The tarball is extracted and 'make install' is run, meaning compiled code from this unverifiable host is executed and installed into the system. There is no PGP signature, only an MD5 checksum (which provides integrity but not authenticity). The host name ('yugioh.vip') has no obvious connection to the project or its organization ('isyscore'), raising legitimate supply-chain concerns. This is a genuine medium-severity issue: executed/installed binary or compiled code sourced from an unofficial, unverifiable third-party host.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=iscfpcx
    
      2pkgver=1.0.9
    
      3pkgrel=18
    
      4pkgdesc="project maintain tool for FreePascal"
    
      5arch=('x86_64')
    
      6url=https://github.com/isyscore/isc-fpbase
    
      7license=('MPL')
    
      8depends=('fpc>=3.2.0')
    
      9source=("http://yugioh.vip:9000/static/$pkgname-$pkgver.tar.gz")
    
      10noextract=()
    
      11md5sums=('520ea541498279e134a639be31b47f07')
    
      12validpgpkeys=()
    
      13
    
      14package() {
    
      15    cd "$srcdir"
    
      16    if [ ! -d "$pkgdir/usr/bin" ]; then
    
      17        mkdir -p "$pkgdir/usr/bin"
    
      18    fi
    
      19    make DESTDIR="$pkgdir" install
    
      20}
    
      21

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2