krat-myrelax

maintainer esclapion · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and extracts an icon theme tarball directly from a personal/unofficial host (esclapion.free.fr) during package() execution via curl piped to tar, bypassing the source=() array entirely. This means there is no integrity verification (no checksums, no VCS pinning), and the content of the archive can change at any time without detection. While icon themes are data rather than executed code, tar extraction into the package tree can include arbitrary files (e.g., scripts placed in locations that get executed later, or path traversal). The host is a personal free.fr hosting account, not an official upstream mirror. The combination of an unverified, mutable archive from an unofficial personal host extracted directly into the package directory is a genuine supply-chain concern, even if the current content is benign icon data.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:19 curl -# http://esclapion.free.fr/AUR/krat-myrelax.tar.gz | tar xzf -

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD downloads and extracts an icon theme tarball directly from a personal/unofficial host (esclapion.free.fr) during package() execution via curl piped to tar, bypassing the source=() array entirely. This means there is no integrity verification (no checksums, no VCS pinning), and the content of the archive can change at any time without detection. While icon themes are data rather than executed code, tar extraction into the package tree can include arbitrary files (e.g., scripts placed in locations that get executed later, or path traversal). The host is a personal free.fr hosting account, not an official upstream mirror. The combination of an unverified, mutable archive from an unofficial personal host extracted directly into the package directory is a genuine supply-chain concern, even if the current content is benign icon data.

PKGBUILD

1 offending line(s) highlighted

      1# Author : zayronxio
    
      2# Maintainer: esclapion <esclapion[at]gmail[dot]com>
    
      3
    
      4pkgname=krat-myrelax
    
      5pkgver=1.0
    
      6pkgrel=2
    
      7pkgdesc="krat-myrelax icons"
    
      8url="http://zayronxio.blogspot.fr/2012/01/krat-myrelax-v-102.html"
    
      9arch=('any')
    
      10license=('GPL')
    
      11depends=()
    
      12optdepends=()
    
      13source=()
    
      14md5sums=()
    
      15package() {
    
      16  dest=${pkgdir}/usr/share/icons/
    
      17  mkdir -p $dest   
    
      18  cd $dest
    
      19  curl -# http://esclapion.free.fr/AUR/krat-myrelax.tar.gz | tar xzf -
    
      20}
    
      21

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2