keeper-password-manager

maintainer malina · 13 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-whitelisted host (keepersecurity.com), which is not inherently malicious but presents a supply-chain risk if the host were compromised, as the binary is not built from source and the checksum, while present, could be bypassed if the download were intercepted or swapped.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 "https://keepersecurity.com/desktop_electron/Linux/repo/deb/keeperpasswordmanager_${pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (keepersecurity.com), which is not inherently malicious but presents a supply-chain risk if the host were compromised, as the binary is not built from source and the checksum, while present, could be bypassed if the download were intercepted or swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mike Hicklen (hicklemon) <mike@xfs.repair>
    
      2# Maintainer: Laszlo Malina <laszlo@malina.hu>
    
      3
    
      4pkgname=keeper-password-manager
    
      5pkgver=18.4.0
    
      6pkgrel=1
    
      7pkgdesc="Keeper is the world's #1 most downloaded password keeper and secure digital 
    
      8 vault for protecting and managing your passwords and other secret information."
    
      9arch=('x86_64')
    
      10url="https://keepersecurity.com"
    
      11license=('LicenseRef-proprietary')
    
      12
    
      13depends=(
    
      14  'gtk3'
    
      15  'libnotify'
    
      16  'nss'
    
      17  'xdg-utils'
    
      18  'at-spi2-core'
    
      19  'libdrm'
    
      20  'mesa'
    
      21  'libxcb'
    
      22  'libxss'
    
      23  'pcsclite'
    
      24  'alsa-lib'
    
      25)
    
      26
    
      27optdepends=(
    
      28  'gnome-keyring: GNOME keyring integration for credential storage'
    
      29  'libsecret: secret storage backend'
    
      30  'pipewire-pulse: PulseAudio-compatible audio (recommended)'
    
      31  'pulseaudio: PulseAudio audio backend (alternative)'
    
      32  'trash-cli: trash support for xdg-utils'
    
      33  'lsb-release: OS version detection'
    
      34)
    
      35
    
      36source=(
    
      37  "https://keepersecurity.com/desktop_electron/Linux/repo/deb/keeperpasswordmanager_${pkgver}_amd64.deb"
    
      38  'LICENSE'
    
      39)
    
      40sha512sums=('e9766afb0b46c44de79e1cf5c9b738a561047a8029f799ee7e70634266c7bb5f3c2dbd4c38e109dd0010079bdc9aaa5b02accbde72d1f73092bb456d6f1b8c6d'
    
      41            '9bd161a552aba146ee89ab930b8a444442d3cb4bba8cf5e94d1a04bfe2c99fae8372d0d04d5b01fe489578429e9fd020cb567e005b1a267fcb51a0bc4cb2f7b2')
    
      42
    
      43package() { 
    
      44  bsdtar -xf "$srcdir"/data.tar.xz -C "$pkgdir"   
    
      45
    
      46  echo "Setting needed '4755' mode to file: chrome-sandbox."
    
      47  chmod 4755 "$pkgdir"/usr/lib/keeperpasswordmanager/chrome-sandbox
    
      48  echo "If you are updating from 16.0.0 to a newer version, you will need to set '755' mode on directories: resources/*, locales, swiftshader - commands are below, USE AT YOUR OWN RISK:"
    
      49  echo 'find /usr/lib/keeperpasswordmanager/resources -type d -print0 | xargs -0 chmod 755'
    
      50  echo 'chmod 755 /usr/lib/keeperpasswordmanager/locales'
    
      51  echo 'chmod 755 /usr/lib/keeperpasswordmanager/swiftshader'
    
      52
    
      53  install -Dm644 LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      54  install -Dm644 "$pkgdir"/usr/lib/keeperpasswordmanager/LICENSES.chromium.html "$pkgdir"/usr/share/licenses/chromium/LICENSES.chromium.html
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2