kartina-tv-bin

maintainer gratuxri · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from kartina.tv (the official service website, not a random personal host), extracts and installs it directly. While kartina.tv is the legitimate upstream vendor for this IPTV service, it is still an unofficial/vendor binary host rather than a standard code repository, and the installed binary runs with user privileges. The sha512sum is present and provides integrity checking against the specific file, mitigating substitution risk at download time. The main concern is that this is a closed-source prebuilt binary from a commercial IPTV service with no source verification possible, and the domain owner could replace the binary at any time (though the checksum would catch that for existing PKGBUILDs). This is a genuine medium-risk pattern: executed binary from a non-standard host with no source code available, but not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=(https://www.kartina.tv/media/ktv_player/kartina.tv_2.11.5_amd64.deb)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from kartina.tv (the official service website, not a random personal host), extracts and installs it directly. While kartina.tv is the legitimate upstream vendor for this IPTV service, it is still an unofficial/vendor binary host rather than a standard code repository, and the installed binary runs with user privileges. The sha512sum is present and provides integrity checking against the specific file, mitigating substitution risk at download time. The main concern is that this is a closed-source prebuilt binary from a commercial IPTV service with no source verification possible, and the domain owner could replace the binary at any time (though the checksum would catch that for existing PKGBUILDs). This is a genuine medium-risk pattern: executed binary from a non-standard host with no source code available, but not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Juri Grabowski <gratuxri@gmail.com>
    
      2
    
      3pkgname=kartina-tv-bin
    
      4pkgver=2.11.5
    
      5pkgrel=0
    
      6epoch=1
    
      7pkgdesc="iptv player for kartina.tv"
    
      8url=http://jo2003.github.io/vlc_record/
    
      9arch=(x86_64)
    
      10license=(GPL)
    
      11depends=()
    
      12provides=(kartina-tv)
    
      13conflicts=(kartina-tv-git)
    
      14
    
      15source_x86_64=(https://www.kartina.tv/media/ktv_player/kartina.tv_2.11.5_amd64.deb)
    
      16
    
      17sha512sums_x86_64=('f387682e9d33d41aa6fed2e48bb3f2d1205a2e9e8b1098a7f923ce94ad964eafb98e30a576eb0015908a11c6cd15b3507452f185237d899fc71e84d82788093c')
    
      18
    
      19
    
      20package() {
    
      21  tar -xf data.tar.?z -C "$pkgdir" ./usr
    
      22}
    
      23
    
      24# vim:set ts=2 sw=2 ft=sh et:
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2