mc-litematica-112-liteloader

maintainer eatmyvenom · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD fetches a manifest JSON from masa.dy.fi (a personal domain belonging to the mod author 'masa') with sha1sums=('SKIP'), then dynamically resolves and downloads a .litemod binary from a URL embedded in that manifest at build time. Two real supply-chain concerns exist: (1) the manifest checksum is skipped entirely, so a compromised or MITM'd manifest could redirect the download to an arbitrary binary; (2) the actual mod binary URL is not known at PKGBUILD review time and has no integrity check whatsoever. The .litemod file is executed code (a Java mod loaded by LiteLoader at Minecraft runtime). While masa.dy.fi appears to be the legitimate upstream author's own hosting for this mod, the pattern of fetching an unchecked manifest and then downloading an unchecked binary from a personal host represents a genuine supply-chain risk — any compromise of that host or a MITM attack would result in arbitrary code execution in the user's Minecraft environment. This is a real medium-severity concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("manifest.json::https://masa.dy.fi/api/games/mods/minecraft/latest/client/")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD fetches a manifest JSON from masa.dy.fi (a personal domain belonging to the mod author 'masa') with sha1sums=('SKIP'), then dynamically resolves and downloads a .litemod binary from a URL embedded in that manifest at build time. Two real supply-chain concerns exist: (1) the manifest checksum is skipped entirely, so a compromised or MITM'd manifest could redirect the download to an arbitrary binary; (2) the actual mod binary URL is not known at PKGBUILD review time and has no integrity check whatsoever. The .litemod file is executed code (a Java mod loaded by LiteLoader at Minecraft runtime). While masa.dy.fi appears to be the legitimate upstream author's own hosting for this mod, the pattern of fetching an unchecked manifest and then downloading an unchecked binary from a personal host represents a genuine supply-chain risk — any compromise of that host or a MITM attack would result in arbitrary code execution in the user's Minecraft environment. This is a real medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: EatMyVenom <eat.my.venomm@gmail.com>
    
      2
    
      3_modname=litematica
    
      4_mcver="1.12.2"
    
      5_modloader="liteloader"
    
      6pkgname=mc-litematica-112-liteloader
    
      7pkgver="0.0.0.dev.20200615.020552"
    
      8pkgrel=1
    
      9pkgdesc="A new schematic mod written from scratch."
    
      10arch=('any')
    
      11url="https://masa.dy.fi/mcmods/client_mods/"
    
      12license=('LGPL')
    
      13makedepends=('wget' 'jq')
    
      14source=("manifest.json::https://masa.dy.fi/api/games/mods/minecraft/latest/client/")
    
      15sha1sums=('SKIP')
    
      16
    
      17pkgver() {
    
      18  cd $srcdir
    
      19  cat manifest.json | jq ".[\"mods\"][\"${_mcver}\"][\"${_modloader}\"][\"${_modname}\"][\"version\"]" | sed 's/-/./g;s/+/./g'
    
      20}
    
      21
    
      22build() {
    
      23  wget $(cat manifest.json | jq -r ".[\"mods\"][\"${_mcver}\"][\"${_modloader}\"][\"${_modname}\"][\"url\"]")
    
      24}
    
      25
    
      26package() {
    
      27  install -d -m 755 "${pkgdir}/usr/share/minecraft"
    
      28
    
      29  cp $(cat manifest.json | jq -r ".[\"mods\"][\"${_mcver}\"][\"${_modloader}\"][\"${_modname}\"][\"filename\"]") \
    
      30     "${pkgdir}/usr/share/minecraft/${_modname}-${_mcver}.litemod"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2