key-mcursor-bin

maintainer crux · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt binary from the project's GitHub releases, which is a common and acceptable practice for AUR packages; while the host is not whitelisted, it is the project's official release infrastructure, and there is no evidence of malicious behavior or unverifiable code execution.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's GitHub releases, which is a common and acceptable practice for AUR packages; while the host is not whitelisted, it is the project's official release infrastructure, and there is no evidence of malicious behavior or unverifiable code execution.

PKGBUILD

      1# Maintainer: crux <c-rrux@outlook.com>
    
      2
    
      3_exec_name=key-mcursor
    
      4pkgname=${_exec_name}-bin
    
      5pkgver=1.1.2
    
      6pkgrel=1
    
      7pkgdesc="Keyboard-driven mouse-cursor control (pre-built binary)"
    
      8arch=('x86_64')
    
      9url="https://github.com/rruxx/$_exec_name"
    
      10license=('AGPL-3.0-or-later')
    
      11provides=("$_exec_name=$pkgver")
    
      12conflicts=("$_exec_name")
    
      13install="$pkgname.install"
    
      14depends=('glibc')
    
      15source=("$url/releases/download/v$pkgver/$_exec_name-v$pkgver-$arch-unknown-linux-gnu.tar.zst")
    
      16sha256sums=('071a1f8d6e68b64d34db1451f706f8ddce1efb1c367385c532ba0ee7dd8b6013')
    
      17
    
      18# Binary tarball — no build step needed, makepkg auto-extracts.
    
      19
    
      20package() {
    
      21    install -Dm755 "$srcdir/$_exec_name"  "$pkgdir/usr/bin/$_exec_name"
    
      22    install -Dm644 "$srcdir/${_exec_name}d.service" \
    
      23        "$pkgdir/usr/lib/systemd/system/${_exec_name}d.service"
    
      24}
    
      25

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 
 _exec_name=key-mcursor
 pkgname=${_exec_name}-bin
-pkgver=1.1.0
+pkgver=1.1.2
 pkgrel=1
 pkgdesc="Keyboard-driven mouse-cursor control (pre-built binary)"
 arch=('x86_64')
@@ -13,7 +13,7 @@
 install="$pkgname.install"
 depends=('glibc')
 source=("$url/releases/download/v$pkgver/$_exec_name-v$pkgver-$arch-unknown-linux-gnu.tar.zst")
-sha256sums=('0633b1ec7e4cf4477da66afac9ed23475ce260b6c544b518978e4ed94df727b3')
+sha256sums=('071a1f8d6e68b64d34db1451f706f8ddce1efb1c367385c532ba0ee7dd8b6013')
 
 # Binary tarball — no build step needed, makepkg auto-extracts.
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 21:16:48	LOW	2
2026-07-30 13:14:23	LOW	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 05:10:22	MEDIUM	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 17:35:03	LOW	2