lastpass
LOW
maintainer darose
96 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads official LastPass extension and native messaging host binaries from the vendor's own domain (lastpass.com and addons.mozilla.org), which is a legitimate source; the non-whitelisted host is the project's official infrastructure, and the installed files are expected components of the LastPass browser integration.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official LastPass extension and native messaging host binaries from the vendor's own domain (lastpass.com and addons.mozilla.org), which is a legitimate source; the non-whitelisted host is the project's official infrastructure, and the installed files are expected components of the LastPass browser integration.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
"lplinux-${_universalver}.tar.bz2::https://download.cloud.lastpass.com/linux/lplinux.tar.bz2"
PKGBUILD
1 offending line(s) highlighted
1
# Previous maintainer: Eli Schwartz <eschwartz@archlinux.org>
2
# Maintainer: David Rosenstrauch <darose@darose.net>
3
4
pkgname=lastpass
5
pkgver=4.151.5
6
pkgrel=1
7
_universalver=4.49.0-1
8
_amo_file=4731825
9
_crx_id=hdokiejnpimakedhajhdlcegeplioahd
10
pkgdesc="The Universal LastPass installer for Firefox, Chrome, and Opera"
11
arch=('i686' 'x86_64')
12
url="https://lastpass.com"
13
license=('custom')
14
makedepends=('unzip')
15
optdepends=('firefox'
16
'chromium'
17
'google-chrome')
18
options=('!strip')
19
# Apparently, API endpoints are all the rage -- so this isn't actually a file...
20
source=("${pkgname}-${pkgver}.xpi::https://addons.mozilla.org/firefox/downloads/file/${_amo_file}/lastpass_password_manager-${pkgver}-an+fx.xpi"
21
"lplinux-${_universalver}.tar.bz2::https://download.cloud.lastpass.com/linux/lplinux.tar.bz2"
22
"com.lastpass.nplastpass.json"
23
"firefox-com.lastpass.nplastpass.json"
24
"lastpass_policy_sources.json"
25
"lastpass_policy_install.json"
26
"License.txt")
27
noextract=("${pkgname}-${pkgver}.xpi")
28
sha256sums=('32c872e52a8b30c17e7fc40d4115ec42cc193efc80b742aefa07ce13e5c94fed'
29
'826e383a6bad905d942e22b14aee67dbc39e8f7a5243d706af787c8fcec6f158'
30
'e8eb3b585809d6644807727c5bd0a74ead96dd2c5a7e6d2ce29e0b6ea28b9e59'
31
'82af9e9296f92e92ca325449e0c2b2deb3c21f65afea45aeb823090cb32aad76'
32
'f82b920620575654fcbc0baf9b5d6c275835cbfc05b779ad309de5c6411c8bc9'
33
'1c061cb5352d84dd6cde4dd6ce3889d41a31fd38acc4d97a7d69709e3d5ac693'
34
'17a871edf1134c498f6e91465f5b3138ba5af7d822e4c253cda81ab929906388')
35
36
# 64-bit?
37
if [[ $CARCH = x86_64 ]]; then
38
_64=64
39
fi
40
41
prepare() {
42
cd "${srcdir}"
43
44
unzip -qqo "${pkgname}-${pkgver}.xpi" -d "${pkgname}-${pkgver}"
45
}
46
47
package() {
48
cd "${srcdir}"
49
50
# universal native messaging host
51
install -Dm755 nplastpass$_64 "$pkgdir"/usr/lib/lastpass/nplastpass
52
53
# Firefox
54
if [[ -f ${pkgname}-${pkgver}/install.rdf ]]; then
55
_extension_id="$(sed -n '/.*<em:id>\(.*\)<\/em:id>.*/{s//\1/p;q}' ${pkgname}-${pkgver}/install.rdf)"
56
else
57
_extension_id="$(sed -n 's/.*"id": "\(.*\)".*/\1/p' ${pkgname}-${pkgver}/manifest.json)"
58
fi
59
_extension_dest="${pkgdir}/usr/lib/firefox/browser/extensions/${_extension_id}"
60
# Should this extension be unpacked or not?
61
if grep -q '<em:unpack>true</em:unpack>' ${pkgname}-${pkgver}/install.rdf 2>/dev/null; then
62
install -dm755 "${_extension_dest}"
63
cp -R ${pkgname}-${pkgver}/* "${_extension_dest}"
64
chmod -R ugo+rX "${_extension_dest}"
65
else
66
install -Dm644 ${pkgname}-${pkgver}.xpi "${_extension_dest}.xpi"
67
fi
68
69
# This cannot use the same (unified) file as chromium. Although chromium
70
# ignores the Mozilla-specific key in *its* native messaging hosts
71
# description, and continues to work, Firefox refuses to recognize the
72
# binary plugin if unknown (chromium-specific) keys are present.
73
install -Dm644 firefox-com.lastpass.nplastpass.json "$pkgdir"/usr/lib/mozilla/native-messaging-hosts/com.lastpass.nplastpass.json
74
75
# Chrome(ium)
76
for i in opt/chrome chromium chromium-dev; do
77
install -Dm644 com.lastpass.nplastpass.json "$pkgdir"/etc/$i/native-messaging-hosts/com.lastpass.nplastpass.json
78
install -Dm644 lastpass_policy_sources.json "$pkgdir"/etc/$i/policies/managed/lastpass.json
79
done
80
for i in google-chrome chromium ; do
81
install -Dm644 lastpass_policy_install.json "$pkgdir"/usr/share/$i/extensions/${_crx_id}.json
82
done
83
84
# Opera
85
# Plugin does not exist in Chrome Webstore version of .crx, install
86
# instructions claim to use that, no viable solution at the moment so this
87
# is disabled until an Opera user is motivated to acquire a source.
88
#install -Dm755 lpchrome-${_chromever}/libnplastpass${_64}.so "${pkgdir}"/usr/lib/opera/plugins/libnplastpass.so
89
90
install -Dm644 License.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
91
}
92
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |