localwp

MEDIUM

maintainer airdiz 27 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt RPM from a non-whitelisted host (cdn.localwp.com), which is an unverifiable executable artifact; if compromised, it could lead to code execution, though the host is plausibly official.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("local-${pkgver}-linux.rpm::https://cdn.localwp.com/releases-stable/${pkgver}+${_build}/local-${pkgver}-linux.rpm")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt RPM from a non-whitelisted host (cdn.localwp.com), which is an unverifiable executable artifact; if compromised, it could lead to code execution, though the host is plausibly official.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Oleksii <aleksieiev.o.y@gmail.com>
    
      2pkgname=localwp
    
      3_pkgname=local
    
      4pkgver=10.1.2
    
      5_build=7004
    
      6pkgrel=7004
    
      7pkgdesc="The #1 local WordPress development tool. (Official .rpm repack)"
    
      8arch=('x86_64')
    
      9url="https://localwp.com/"
    
      10license=('custom:proprietary')
    
      11depends=('libxcrypt-compat' 'numactl' 'ncurses5-compat-libs' 'libaio' 'gtk3' 'nss' 'libjpeg-turbo' 'libxss' 'libxslt')
    
      12provides=('local-by-flywheel-bin')
    
      13conflicts=('local-by-flywheel-bin')
    
      14options=('!strip' 'emptydirs')
    
      15source=("local-${pkgver}-linux.rpm::https://cdn.localwp.com/releases-stable/${pkgver}+${_build}/local-${pkgver}-linux.rpm")
    
      16sha1sums=('9d909b09e8a40b58bafeff1d2a897165ae195f6a')
    
      17
    
      18package() {
    
      19  # Unpacking within the s r c directory happens automatically
    
      20  # Copy the structure to the package folder
    
      21  cp -ra "${srcdir}/usr" "${pkgdir}/"
    
      22  cp -ra "${srcdir}/opt" "${pkgdir}/"
    
      23
    
      24  # Let's create a convenient symbolic link to run the command 'localwp'
    
      25  install -d "${pkgdir}/usr/bin"
    
      26  ln -sf /opt/Local/local "${pkgdir}/usr/bin/${pkgname}"
    
      27
    
      28  # Fix for the Electron sandbox
    
      29  chmod u+s "${pkgdir}/opt/Local/chrome-sandbox"
    
      30}
    
      31

Changes since previous scan

--- PKGBUILD @ 2026-10-17 00:21
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,9 +1,9 @@
 # Maintainer: Oleksii <aleksieiev.o.y@gmail.com>
 pkgname=localwp
 _pkgname=local
-pkgver=10.1.1
-_build=6939
-pkgrel=6939
+pkgver=10.1.2
+_build=7004
+pkgrel=7004
 pkgdesc="The #1 local WordPress development tool. (Official .rpm repack)"
 arch=('x86_64')
 url="https://localwp.com/"
@@ -13,7 +13,7 @@
 conflicts=('local-by-flywheel-bin')
 options=('!strip' 'emptydirs')
 source=("local-${pkgver}-linux.rpm::https://cdn.localwp.com/releases-stable/${pkgver}+${_build}/local-${pkgver}-linux.rpm")
-sha1sums=('1d9ad5cbd7afeaeec71ecdcf7edbbb63a166553d')
+sha1sums=('9d909b09e8a40b58bafeff1d2a897165ae195f6a')
 
 package() {
   # Unpacking within the s r c directory happens automatically

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 09:17:40	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2