llmster-bin

MEDIUM

maintainer Mailaender 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Downloads and installs a prebuilt binary bundle from llmster.lmstudio.ai (a non-standard subdomain host); while this appears to be LM Studio's own official infrastructure, it is an unverifiable prebuilt executable that gets installed and run directly, and the host is not a well-known release infrastructure like GitHub releases, making it a moderate supply-chain risk if the subdomain were compromised or swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("${pkgname}-${_upver}-x86_64.tar.gz::https://llmster.lmstudio.ai/download/${_upver}-linux-x64.full.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and installs a prebuilt binary bundle from llmster.lmstudio.ai (a non-standard subdomain host); while this appears to be LM Studio's own official infrastructure, it is an unverifiable prebuilt executable that gets installed and run directly, and the host is not a well-known release infrastructure like GitHub releases, making it a moderate supply-chain risk if the subdomain were compromised or swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: matthias
    
      2pkgname=llmster-bin
    
      3pkgver=0.0.25
    
      4_uprel=1
    
      5_upver="${pkgver}-${_uprel}"
    
      6pkgrel=1
    
      7pkgdesc="LM Studio's headless daemon"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://lmstudio.ai/docs/developer/core/headless_llmster"
    
      10license=('custom')
    
      11depends=('glibc' 'gcc-libs')
    
      12options=('!strip' '!debug')
    
      13provides=('llmster')
    
      14conflicts=('llmster' 'lmstudio')
    
      15install="${pkgname}.install"
    
      16
    
      17# Append "+cuda12" for the CUDA 12 bundle.
    
      18source=("${pkgname}-${_upver}-x86_64.tar.gz::https://llmster.lmstudio.ai/download/${_upver}-linux-x64.full.tar.gz")
    
      19noextract=("${pkgname}-${_upver}-x86_64.tar.gz")
    
      20sha512sums=('4d119af740379fc7509894d761a85183420a6dd3cb994596a1b6e4b37208a5d3e8cb94ffe583115b1473a6722bab5fffc09b90eb22c755f5dde1458774ab4951')
    
      21
    
      22prepare() {
    
      23  # The tarball has no top-level directory, so unpack it into its own folder.
    
      24  rm -rf bundle
    
      25  mkdir bundle
    
      26  bsdtar -xf "${pkgname}-${_upver}-${CARCH}"*.tar.gz -C bundle
    
      27}
    
      28
    
      29package() {
    
      30  install -d "${pkgdir}/opt/llmster" "${pkgdir}/usr/bin"
    
      31  cp -a bundle/. "${pkgdir}/opt/llmster/"
    
      32  ln -s /opt/llmster/llmster "${pkgdir}/usr/bin/llmster"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 00:06:47	Medium	3
2026-10-13 17:19:38	Medium	3
2026-10-13 17:17:20	Medium	3