lith

MEDIUM

maintainer dcooper 0 votes scanned 2026-09-18 17:28:51.851564

View on AUR

Why flagged

The package installs a prebuilt AppImage from a GitHub release, which is an unverifiable executable binary; if the source were swapped, it could execute arbitrary code, though it comes from a project-associated repository.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt AppImage from a GitHub release, which is an unverifiable executable binary; if the source were swapped, it could execute arbitrary code, though it comes from a project-associated repository.

PKGBUILD

      1pkgname=lith
    
      2pkgver=2.0.40
    
      3pkgrel=1
    
      4pkgdesc='Maple Story 2 launcher'
    
      5arch=('x86_64')
    
      6url='https://www.lith.cat'
    
      7depends=('umu-launcher')
    
      8
    
      9_bin_name="Lith.Launcher-${pkgver}-x64.AppImage"
    
      10source=("https://github.com/LithMS/Lith-Artifacts/releases/download/v${pkgver}/${_bin_name}")
    
      11sha256sums=('cb5bbb130c5b4932cbc3c3134bacf4fc52495e79974132d9f85defa5858540e5')
    
      12
    
      13package() {
    
      14    install -Dm 755 "${srcdir}/${_bin_name}" "${pkgdir}/usr/bin/${pkgname}"
    
      15}
    
      16

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-18 17:28:51	Medium	2