lxt

maintainer ZephyrDRH · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is hosted on the project maintainer's plausible personal domain, building from the project's own source tarball is normal for AUR packages, and the software is a simple file manager with no indication of malicious intent or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is hosted on the project maintainer's plausible personal domain, building from the project's own source tarball is normal for AUR packages, and the software is a simple file manager with no indication of malicious intent or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("http://www.stahlke.org/dan/$pkgname/$pkgname-$pkgver.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zephyrdrh <zephyrdrh at gmx dot de>
    
      2# Contributor: aksr <aksr at t-com dot me>
    
      3pkgname=lxt
    
      4pkgver=1.3c
    
      5pkgrel=1
    
      6pkgdesc="A file manager program, that was inspired by the popular DOS program XTreeGold."
    
      7arch=('i686' 'x86_64')
    
      8url="http://www.stahlke.org/dan/lxt/"
    
      9license=("BSD-3-Clause")
    
      10depends=(glibc ncurses)
    
      11source=("http://www.stahlke.org/dan/$pkgname/$pkgname-$pkgver.tar.gz")
    
      12b2sums=('b52e38c005cd408c35772a4a6fc594466093fd858ee78fddeb7a44a7b39129f7669cb6c486fdb2a24334c9328ed2c5a99e46bd896772796dc709b3255c683b74')
    
      13
    
      14build() {
    
      15  cd "$srcdir/$pkgname-$pkgver"
    
      16  ./configure --prefix=/usr
    
      17  make
    
      18}
    
      19
    
      20check() {
    
      21  cd "$srcdir/$pkgname-$pkgver"
    
      22  make -k check
    
      23}
    
      24
    
      25package() {
    
      26  cd "$srcdir/$pkgname-$pkgver"
    
      27  make DESTDIR="$pkgdir/" install
    
      28  install -Dm644 COPYING "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      29}
    
      30
    
      31# vim:set ts=2 sw=2 et:
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2