mari0-ae-bin

maintainer bloxxel64colon3 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt AppImage is downloaded from Dropbox (a personal/unofficial host, not the project's GitHub releases), extracted, and its internal 'love' binary is installed as an executable. Dropbox links can be silently replaced by the link owner at any time without changing the URL, making the sha256sum the only integrity guard — which is present but only as strong as the initial capture. The binary itself is executed during the build (--appimage-extract runs the AppImage), and the resulting native binary is installed. This is a genuine supply-chain concern: an unofficial, mutable host serving an executed binary with no GPG signature. The sha256sum provides some protection but does not eliminate the risk of the original link having been set to a malicious payload before the sum was recorded. Medium severity is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("${pkgname}-${pkgver}.zip::https://www.dropbox.com/scl/fi/1zrtqil96p54pjzlmk0le/alesan99s_entities_13.2-linux.zip?rlkey=8phtksssm1nzuxiebklekt9ep&st=asjr4v3j&dl=1")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): A prebuilt AppImage is downloaded from Dropbox (a personal/unofficial host, not the project's GitHub releases), extracted, and its internal 'love' binary is installed as an executable. Dropbox links can be silently replaced by the link owner at any time without changing the URL, making the sha256sum the only integrity guard — which is present but only as strong as the initial capture. The binary itself is executed during the build (--appimage-extract runs the AppImage), and the resulting native binary is installed. This is a genuine supply-chain concern: an unofficial, mutable host serving an executed binary with no GPG signature. The sha256sum provides some protection but does not eliminate the risk of the original link having been set to a malicious payload before the sum was recorded. Medium severity is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bloxxel64colonthree @ discord
    
      2pkgname=mari0-ae-bin
    
      3pkgver=13.2
    
      4pkgrel=1
    
      5pkgdesc="A mod/continuation of the original Mari0 with more objects and features, considered the definitive version." 
    
      6arch=('x86_64')
    
      7url='https://github.com/alesan99/mari0_ae'
    
      8license=('WTFPL')
    
      9source=("${pkgname}-${pkgver}.zip::https://www.dropbox.com/scl/fi/1zrtqil96p54pjzlmk0le/alesan99s_entities_13.2-linux.zip?rlkey=8phtksssm1nzuxiebklekt9ep&st=asjr4v3j&dl=1")
    
      10sha256sums=(38bda444c339e6f199519a70b9484c962f40e1e9e8eb07bace285d4fac975f45)
    
      11
    
      12depends=('love')
    
      13
    
      14package(){
    
      15    ./mari0_ae.AppImage --appimage-extract
    
      16    install -Dm755 "${srcdir}/squashfs-root/bin/love" "$pkgdir/usr/share/${pkgname}/${pkgname}"
    
      17}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2