loadlibrary-git

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 "mpam-fe.exe::http://go.microsoft.com/fwlink/?LinkID=121721&arch=x86")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads mpam-fe.exe from Microsoft's go.microsoft.com fwlink redirect (a legitimate Microsoft URL used for Windows Defender definition updates), extracts it with cabextract, and installs mpengine.dll and .vdm files into the package. The source is genuinely Microsoft's Windows Defender engine/definitions package, so the host is not unofficial or personal. However, the checksum is explicitly skipped with the comment 'ever changing checksum', meaning there is no integrity verification of the downloaded binary. The extracted mpengine.dll is a Windows PE DLL that gets loaded and executed on Linux via the loadlibrary PE loader — this is the entire point of the project (taviso/loadlibrary is a well-known research project by Tavis Ormandy). The real concern is: (1) no checksum on a binary that gets executed, meaning a MITM or Microsoft-side substitution would go undetected, and (2) a Windows DLL is being loaded and run in a Linux process context. The fwlink URL is a legitimate Microsoft redirect, not a personal/unofficial host, so this is less concerning than a truly unknown host. The risk is real but inherent to the project's design rather than malicious packaging intent. Rating medium is appropriate due to the unchecksumed executable binary that gets loaded/executed.