lody-bin
maintainer Qingxu
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt .deb binary from a non-whitelisted, project-specific domain (updates.lody.ai), which presents a supply-chain risk if the host were compromised or the download intercepted, though the checksum is verified.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:40
"$pkgname-$pkgver-amd64.deb::https://updates.lody.ai/production/Lody-$pkgver-amd64.deb"
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-whitelisted, project-specific domain (updates.lody.ai), which presents a supply-chain risk if the host were compromised or the download intercepted, though the checksum is verified.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Qingxu <me@linioi.com>
2
pkgname=lody-bin
3
pkgver=0.73.0
4
pkgrel=1
5
pkgdesc='A development platform built for parallel AI Agent workflows'
6
url='https://lody.ai'
7
arch=(
8
'x86_64'
9
)
10
license=(
11
'LicenseRef-proprietary'
12
)
13
depends=(
14
'alsa-lib'
15
'at-spi2-core'
16
'gtk3'
17
'libnotify'
18
'libsecret'
19
'libxss'
20
'libxtst'
21
'nss'
22
'org.freedesktop.secrets'
23
'util-linux-libs'
24
'xdg-utils'
25
)
26
optdepends=(
27
'libappindicator: tray icon support'
28
)
29
provides=(
30
'lody'
31
)
32
conflicts=(
33
'lody'
34
)
35
options=(
36
'!strip'
37
'!debug'
38
)
39
source=(
40
"$pkgname-$pkgver-amd64.deb::https://updates.lody.ai/production/Lody-$pkgver-amd64.deb"
41
)
42
noextract=(
43
"$pkgname-$pkgver-amd64.deb"
44
)
45
sha256sums=('b0f2b186fdbc2c5a17a0957bd823110b433e5bbea6ed1a909b67e4c4f57a2416')
46
47
package() {
48
local _deb="$srcdir/$pkgname-$pkgver-amd64.deb"
49
50
ar p "$_deb" data.tar.xz | bsdtar -xJf - -C "$pkgdir"
51
52
install -dm755 "$pkgdir/usr/bin"
53
ln -s /opt/Lody/lodyDesktop "$pkgdir/usr/bin/lody"
54
55
sed -i \
56
-e 's|/opt/Lody/lodyDesktop|lody|' \
57
-e 's|Icon=lodyDesktop|Icon=lody|' \
58
"$pkgdir/usr/share/applications/lodyDesktop.desktop"
59
60
mv "$pkgdir/usr/share/icons/hicolor/512x512/apps/lodyDesktop.png" \
61
"$pkgdir/usr/share/icons/hicolor/512x512/apps/lody.png"
62
63
rm -rf "$pkgdir/usr/share/doc"
64
65
install -Dm644 "$pkgdir/opt/Lody/LICENSE.electron.txt" \
66
"$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
67
install -Dm644 "$pkgdir/opt/Lody/LICENSES.chromium.html" \
68
"$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
69
}
70
Changes since previous scan
--- PKGBUILD @ 2026-07-27 00:24+++ PKGBUILD @ 2026-08-03 00:08@@ -1,6 +1,6 @@ # Maintainer: Qingxu <me@linioi.com> pkgname=lody-bin-pkgver=0.71.2+pkgver=0.73.0 pkgrel=1 pkgdesc='A development platform built for parallel AI Agent workflows' url='https://lody.ai'@@ -42,7 +42,7 @@ noextract=( "$pkgname-$pkgver-amd64.deb" )-sha256sums=('910fd84c92f27454c35528c49910e89a10bce8003d387e22cb9f1f63eceb14c3')+sha256sums=('b0f2b186fdbc2c5a17a0957bd823110b433e5bbea6ed1a909b67e4c4f57a2416') package() { local _deb="$srcdir/$pkgname-$pkgver-amd64.deb"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 11:35:00 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 15:32:35 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 07:22:42 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 05:56:57 | MEDIUM | 2 |