jupyterlab-desktop

MEDIUM

maintainer orphaned 0 votes scanned 2026-09-11 15:22:58.728112

View on AUR

Why flagged

Installs a prebuilt .deb from GitHub releases without source verification; the binary payload could be swapped by an attacker with no detection due to SKIP'd checksum.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): Installs a prebuilt .deb from GitHub releases without source verification; the binary payload could be swapped by an attacker with no detection due to SKIP'd checksum.

PKGBUILD

      1# Maintainer: mnabila nblid48[at]gmail[dot]com
    
      2
    
      3pkgname=jupyterlab-desktop
    
      4pkgver=3.2.1
    
      5pkgrel=1
    
      6pkgdesc="JupyterLab desktop application, based on Electron."
    
      7
    
      8url="https://github.com/jupyterlab/jupyterlab-desktop"
    
      9license=("MIT License")
    
      10
    
      11arch=('x86_64')
    
      12source=("https://github.com/jupyterlab/jupyterlab-desktop/releases/download/$pkgver-$pkgrel/JupyterLab-Setup-Debian.deb")
    
      13
    
      14md5sums=('SKIP')
    
      15
    
      16prepare(){
    
      17    cd $srcdir
    
      18    tar -xf data.tar.xz
    
      19}
    
      20
    
      21package() {
    
      22    cd $srcdir
    
      23    mv usr $pkgdir/
    
      24    mv opt $pkgdir/
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-11 15:22:58	Medium	2