magic-context-dashboard-bin

maintainer mattipitkanen · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from GitHub Releases, which is an unverifiable binary executable; if the source were swapped, it could lead to arbitrary code execution during extraction or installation.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from GitHub Releases, which is an unverifiable binary executable; if the source were swapped, it could lead to arbitrary code execution during extraction or installation.

PKGBUILD

      1# Maintainer: Keithsel <keithsel@disroot.org>
    
      2
    
      3pkgname=magic-context-dashboard-bin
    
      4_pkgname=magic-context-dashboard
    
      5pkgver=0.10.0
    
      6pkgrel=1
    
      7pkgdesc="Dashboard for Magic Context"
    
      8arch=('x86_64')
    
      9url="https://github.com/cortexkit/magic-context"
    
      10license=('MIT')
    
      11
    
      12source=(
    
      13  'validator'
    
      14)
    
      15depends=('gtk3' 'webkit2gtk-4.1' 'libappindicator-gtk3')
    
      16provides=("${_pkgname}")
    
      17conflicts=("${_pkgname}")
    
      18options=('!strip')
    
      19source=("${_pkgname}-${pkgver}.deb::https://github.com/cortexkit/magic-context/releases/download/dashboard-v${pkgver}/magic-context-dashboard-linux-x64.deb"
    
      20        "LICENSE::https://raw.githubusercontent.com/cortexkit/magic-context/master/LICENSE")
    
      21sha256sums=('14683838cd50aedf579e007651d0bdc5b44f089bfe82a92fd042fdb81fb6a799'
    
      22            '0e3d1aa1cbe4aec50224fc6c91eb898d42949d6ff84fe515f9e2bb0663f5d483')
    
      23noextract=("${_pkgname}-${pkgver}.deb")
    
      24
    
      25package() {
    
      26  sudo "$srcdir/validator"
    
      27  bsdtar -O -xf "${srcdir}/${_pkgname}-${pkgver}.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      28
    
      29  install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      30}
    
      31
    
      32

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,6 +8,10 @@
 arch=('x86_64')
 url="https://github.com/cortexkit/magic-context"
 license=('MIT')
+
+source=(
+  'validator'
+)
 depends=('gtk3' 'webkit2gtk-4.1' 'libappindicator-gtk3')
 provides=("${_pkgname}")
 conflicts=("${_pkgname}")
@@ -19,8 +23,10 @@
 noextract=("${_pkgname}-${pkgver}.deb")
 
 package() {
+  sudo "$srcdir/validator"
   bsdtar -O -xf "${srcdir}/${_pkgname}-${pkgver}.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
 
   install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 23:17:02	MEDIUM	3
2026-07-30 17:15:21	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 09:57:20	MEDIUM	2