markamd-appimage

maintainer Cleboost · 1 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package downloads a prebuilt AppImage from a GitHub release, which is an unverifiable executable binary; if the source were swapped, it could execute arbitrary code, representing a supply-chain risk despite the project's plausible origin.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt AppImage from a GitHub release, which is an unverifiable executable binary; if the source were swapped, it could execute arbitrary code, representing a supply-chain risk despite the project's plausible origin.

PKGBUILD

      1# Maintainer: Cleboost <clement.balarot@gmail.com>
    
      2# Contributor: missing-aur project <https://github.com/Cleboost/missing-aur>
    
      3
    
      4pkgname=markamd-appimage
    
      5pkgver=1.7.2
    
      6pkgrel=1
    
      7pkgdesc="Local-first markdown editor with live preview, reading mode, diagrams, themes, and context bundles (AppImage)"
    
      8url="https://github.com/mattenarle10/markamd"
    
      9arch=("x86_64")
    
      10depends=("fuse2")
    
      11options=("!strip")
    
      12license=("MIT")
    
      13
    
      14source=("markamd-appimage-${pkgver}.AppImage::${url}/releases/download/v${pkgver}/marka.md_${pkgver}_amd64.AppImage" "marka.md.png::https://raw.githubusercontent.com/mattenarle10/markamd/main/src-tauri/icons/128x128@2x.png" "marka.md.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/markamd/marka.md.desktop")
    
      15sha256sums=('a4cefcd7d40bc04281e0060175f6fe81b3f6f55359bd02e1bc2ba230f7455226'
    
      16            '5e678fe988a763a6bdf8ac50ec38db2f542dd4e99eb5d157af496d531cb51b39'
    
      17            '58f6fa06e28241c76c45286ff235edc7abd98cc22d3e380e088213c3329ccfff')
    
      18
    
      19prepare() {
    
      20  chmod +x "${srcdir}/markamd-appimage-${pkgver}.AppImage"
    
      21}
    
      22
    
      23package() {
    
      24  install -Dm755 "${srcdir}/markamd-appimage-${pkgver}.AppImage" "${pkgdir}/opt/markamd-appimage/marka.md.AppImage"
    
      25  install -dm755 "${pkgdir}/usr/bin"
    
      26  ln -sf "/opt/markamd-appimage/marka.md.AppImage" "${pkgdir}/usr/bin/marka.md"
    
      27  install -Dm644 "${srcdir}/marka.md.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/marka.md.png"
    
      28  install -Dm644 "${srcdir}/marka.md.desktop" "${pkgdir}/usr/share/applications/marka.md.desktop"
    
      29}
    
      30
    
      31

Changes since previous scan

--- PKGBUILD @ 2026-08-16 00:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,7 +2,7 @@
 # Contributor: missing-aur project <https://github.com/Cleboost/missing-aur>
 
 pkgname=markamd-appimage
-pkgver=1.7.1
+pkgver=1.7.2
 pkgrel=1
 pkgdesc="Local-first markdown editor with live preview, reading mode, diagrams, themes, and context bundles (AppImage)"
 url="https://github.com/mattenarle10/markamd"
@@ -12,7 +12,7 @@
 license=("MIT")
 
 source=("markamd-appimage-${pkgver}.AppImage::${url}/releases/download/v${pkgver}/marka.md_${pkgver}_amd64.AppImage" "marka.md.png::https://raw.githubusercontent.com/mattenarle10/markamd/main/src-tauri/icons/128x128@2x.png" "marka.md.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/markamd/marka.md.desktop")
-sha256sums=('ba8bd156d76f27dff4e5134bd1b05f479146c4077cbabc6a0a691544c899a09f'
+sha256sums=('a4cefcd7d40bc04281e0060175f6fe81b3f6f55359bd02e1bc2ba230f7455226'
             '5e678fe988a763a6bdf8ac50ec38db2f542dd4e99eb5d157af496d531cb51b39'
             '58f6fa06e28241c76c45286ff235edc7abd98cc22d3e380e088213c3329ccfff')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 01:31:50	MEDIUM	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 13:23:33	LOW	2