lastpass

maintainer darose · 96 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads official LastPass extension and native messaging host binaries from the vendor's own domain (lastpass.com and addons.mozilla.org), which is a legitimate source; the non-whitelisted host is the project's official infrastructure, and the installed files are expected components of the LastPass browser integration.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official LastPass extension and native messaging host binaries from the vendor's own domain (lastpass.com and addons.mozilla.org), which is a legitimate source; the non-whitelisted host is the project's official infrastructure, and the installed files are expected components of the LastPass browser integration.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 "lplinux-${_universalver}.tar.bz2::https://download.cloud.lastpass.com/linux/lplinux.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Previous maintainer: Eli Schwartz <eschwartz@archlinux.org>
    
      2# Maintainer: David Rosenstrauch <darose@darose.net>
    
      3
    
      4pkgname=lastpass
    
      5pkgver=4.151.5
    
      6pkgrel=1
    
      7_universalver=4.49.0-1
    
      8_amo_file=4731825
    
      9_crx_id=hdokiejnpimakedhajhdlcegeplioahd
    
      10pkgdesc="The Universal LastPass installer for Firefox, Chrome, and Opera"
    
      11arch=('i686' 'x86_64')
    
      12url="https://lastpass.com"
    
      13license=('custom')
    
      14makedepends=('unzip')
    
      15optdepends=('firefox'
    
      16            'chromium'
    
      17            'google-chrome')
    
      18options=('!strip')
    
      19# Apparently, API endpoints are all the rage -- so this isn't actually a file...
    
      20source=("${pkgname}-${pkgver}.xpi::https://addons.mozilla.org/firefox/downloads/file/${_amo_file}/lastpass_password_manager-${pkgver}-an+fx.xpi"
    
      21        "lplinux-${_universalver}.tar.bz2::https://download.cloud.lastpass.com/linux/lplinux.tar.bz2"
    
      22        "com.lastpass.nplastpass.json"
    
      23        "firefox-com.lastpass.nplastpass.json"
    
      24        "lastpass_policy_sources.json"
    
      25        "lastpass_policy_install.json"
    
      26        "License.txt")
    
      27noextract=("${pkgname}-${pkgver}.xpi")
    
      28sha256sums=('32c872e52a8b30c17e7fc40d4115ec42cc193efc80b742aefa07ce13e5c94fed'
    
      29            '826e383a6bad905d942e22b14aee67dbc39e8f7a5243d706af787c8fcec6f158'
    
      30            'e8eb3b585809d6644807727c5bd0a74ead96dd2c5a7e6d2ce29e0b6ea28b9e59'
    
      31            '82af9e9296f92e92ca325449e0c2b2deb3c21f65afea45aeb823090cb32aad76'
    
      32            'f82b920620575654fcbc0baf9b5d6c275835cbfc05b779ad309de5c6411c8bc9'
    
      33            '1c061cb5352d84dd6cde4dd6ce3889d41a31fd38acc4d97a7d69709e3d5ac693'
    
      34            '17a871edf1134c498f6e91465f5b3138ba5af7d822e4c253cda81ab929906388')
    
      35
    
      36# 64-bit?
    
      37if [[ $CARCH = x86_64 ]]; then
    
      38    _64=64
    
      39fi
    
      40
    
      41prepare() {
    
      42    cd "${srcdir}"
    
      43
    
      44    unzip -qqo "${pkgname}-${pkgver}.xpi" -d "${pkgname}-${pkgver}"
    
      45}
    
      46
    
      47package() {
    
      48    cd "${srcdir}"
    
      49
    
      50    # universal native messaging host
    
      51    install -Dm755 nplastpass$_64 "$pkgdir"/usr/lib/lastpass/nplastpass
    
      52
    
      53    # Firefox
    
      54    if [[ -f ${pkgname}-${pkgver}/install.rdf ]]; then
    
      55        _extension_id="$(sed -n '/.*<em:id>\(.*\)<\/em:id>.*/{s//\1/p;q}' ${pkgname}-${pkgver}/install.rdf)"
    
      56    else
    
      57        _extension_id="$(sed -n 's/.*"id": "\(.*\)".*/\1/p' ${pkgname}-${pkgver}/manifest.json)"
    
      58    fi
    
      59    _extension_dest="${pkgdir}/usr/lib/firefox/browser/extensions/${_extension_id}"
    
      60    # Should this extension be unpacked or not?
    
      61    if grep -q '<em:unpack>true</em:unpack>' ${pkgname}-${pkgver}/install.rdf 2>/dev/null; then
    
      62        install -dm755 "${_extension_dest}"
    
      63        cp -R ${pkgname}-${pkgver}/* "${_extension_dest}"
    
      64        chmod -R ugo+rX "${_extension_dest}"
    
      65    else
    
      66        install -Dm644 ${pkgname}-${pkgver}.xpi "${_extension_dest}.xpi"
    
      67    fi
    
      68
    
      69    # This cannot use the same (unified) file as chromium. Although chromium
    
      70    # ignores the Mozilla-specific key in *its* native messaging hosts
    
      71    # description, and continues to work, Firefox refuses to recognize the
    
      72    # binary plugin if unknown (chromium-specific) keys are present.
    
      73    install -Dm644 firefox-com.lastpass.nplastpass.json "$pkgdir"/usr/lib/mozilla/native-messaging-hosts/com.lastpass.nplastpass.json
    
      74
    
      75    # Chrome(ium)
    
      76    for i in opt/chrome chromium chromium-dev; do
    
      77        install -Dm644 com.lastpass.nplastpass.json "$pkgdir"/etc/$i/native-messaging-hosts/com.lastpass.nplastpass.json
    
      78        install -Dm644 lastpass_policy_sources.json "$pkgdir"/etc/$i/policies/managed/lastpass.json
    
      79    done
    
      80    for i in google-chrome chromium ; do
    
      81        install -Dm644 lastpass_policy_install.json "$pkgdir"/usr/share/$i/extensions/${_crx_id}.json
    
      82    done
    
      83
    
      84    # Opera
    
      85    # Plugin does not exist in Chrome Webstore version of .crx, install
    
      86    # instructions claim to use that, no viable solution at the moment so this
    
      87    # is disabled until an Opera user is motivated to acquire a source.
    
      88    #install -Dm755 lpchrome-${_chromever}/libnplastpass${_64}.so "${pkgdir}"/usr/lib/opera/plugins/libnplastpass.so
    
      89
    
      90    install -Dm644 License.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      91}
    
      92

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2