lotterhoffcrash

maintainer przemub · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt Windows PE executable (lotterhoffcrash.exe) is downloaded from a personal/unofficial host (1mi.pl/~lachcim/) with no verifiable upstream provenance. It is installed to /opt and executed via Wine. The MD5 checksum provides minimal integrity assurance (MD5 is cryptographically broken and the host could serve a different binary). This is a genuine supply-chain concern: if the personal host is compromised or the file is replaced, arbitrary code runs on the user's system via Wine. The launcher script is sourced locally (no URL), which is fine. The package is not clearly malicious, but the combination of an unofficial personal host, a prebuilt binary, and weak checksums warrants a MEDIUM rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(launcher https://1mi.pl/~lachcim/wa%c5%bcne%20programy/lotterhoffcrash.exe)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): A prebuilt Windows PE executable (lotterhoffcrash.exe) is downloaded from a personal/unofficial host (1mi.pl/~lachcim/) with no verifiable upstream provenance. It is installed to /opt and executed via Wine. The MD5 checksum provides minimal integrity assurance (MD5 is cryptographically broken and the host could serve a different binary). This is a genuine supply-chain concern: if the personal host is compromised or the file is replaced, arbitrary code runs on the user's system via Wine. The launcher script is sourced locally (no URL), which is fine. The package is not clearly malicious, but the combination of an unofficial personal host, a prebuilt binary, and weak checksums warrants a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Przemysław Buczkowski <przemub@przemub.pl>
    
      2
    
      3pkgname=lotterhoffcrash
    
      4pkgver=1.0
    
      5pkgrel=1
    
      6pkgdesc="Enhance your Arch Linux experience with Miss Lotterhoff and Mr Dobecki"
    
      7arch=(i686 x86_64)
    
      8url="https://1mi.pl/~lachcim/wa%c5%bcne%20programy/"
    
      9license=('unknown')
    
      10depends=(wine wine-mono)
    
      11source=(launcher https://1mi.pl/~lachcim/wa%c5%bcne%20programy/lotterhoffcrash.exe)
    
      12md5sums=('4e4996896dcc7252a3aba80627c55636'
    
      13         'a464cbac89bf42cb3a3d120b022e11be')
    
      14
    
      15package() {
    
      16	mkdir -p $pkgdir/usr/bin
    
      17	cp launcher $pkgdir/usr/bin/lotterhoffcrash
    
      18
    
      19	mkdir -p $pkgdir/opt
    
      20	cp lotterhoffcrash.exe $pkgdir/opt
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2