libmmd

LOW

maintainer orphaned 0 votes scanned 2026-11-01 04:01:13.569354

View on AUR

Why flagged

Downloads a source tarball from a non-whitelisted personal/project host (frostworx.de) but has an md5sum checksum, builds from source with cmake/make, and installs a library — no prebuilt binary execution, no obfuscation, no exfiltration; the main concern is the non-standard host and low vote count, not any malicious behaviour.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a source tarball from a non-whitelisted personal/project host (frostworx.de) but has an md5sum checksum, builds from source with cmake/make, and installs a library — no prebuilt binary execution, no obfuscation, no exfiltration; the main concern is the non-standard host and low vote count, not any malicious behaviour.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=(http://frostworx.de/files/$pkgname-$pkgver.tar.gz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Julien Savard <juju2143@gmail.com>
    
      2pkgname=libmmd
    
      3pkgver=0.7.4.3
    
      4pkgrel=1
    
      5pkgdesc="A renderlib for mikumiku dance pmd model and vmd motion files"
    
      6url="http://frostworx.de/"
    
      7arch=('i686' 'x86_64')
    
      8license=('GPL2')
    
      9depends=('bullet' 'sfml')
    
      10makedepends=('make' 'cmake')
    
      11conflicts=()
    
      12replaces=()
    
      13backup=()
    
      14install=
    
      15source=(http://frostworx.de/files/$pkgname-$pkgver.tar.gz)
    
      16md5sums=('324b9b906f82ae08753105be13a684aa')
    
      17
    
      18build() {
    
      19  cd "$srcdir/$pkgname-$pkgver"
    
      20  cmake -DCMAKE_INSTALL_PREFIX=/usr -DDEBUG=ON -DWANTBULLET=ON .
    
      21  make || return 1
    
      22}
    
      23
    
      24package() {
    
      25  cd "$srcdir/$pkgname-$pkgver"
    
      26  make DESTDIR="$pkgdir/" install
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 04:01:13	Low	3
2026-11-01 03:59:29	Medium	2