mc-litematica-117-fabric

maintainer eatmyvenom · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD fetches a JSON manifest from masa.dy.fi (the personal/project site of the well-known Minecraft modder 'masa'), then dynamically resolves and downloads a JAR file URL from that manifest at build time. Two real concerns exist: (1) The actual JAR is downloaded in build() via wget with no integrity check — only the manifest JSON has a sha1sum, so the JAR itself is completely unverified and could be silently replaced or tampered with. (2) The source URL is a personal/project host rather than an official distribution channel like CurseForge or Modrinth, meaning there is no third-party verification layer. The JAR is a Java executable that gets installed to /usr/share/minecraft and will be loaded by the Minecraft client. This is a genuine supply-chain concern: a compromised masa.dy.fi server or MITM could substitute a malicious JAR with no checksum to catch it. That said, masa.dy.fi is the legitimate upstream distribution host for masa's mods (litematica, malilib, etc.) and this is not an obviously malicious pattern — it is sloppy packaging of a real mod. The medium rating is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("manifest.json::https://masa.dy.fi/api/games/mods/minecraft/latest/client/")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD fetches a JSON manifest from masa.dy.fi (the personal/project site of the well-known Minecraft modder 'masa'), then dynamically resolves and downloads a JAR file URL from that manifest at build time. Two real concerns exist: (1) The actual JAR is downloaded in build() via wget with no integrity check — only the manifest JSON has a sha1sum, so the JAR itself is completely unverified and could be silently replaced or tampered with. (2) The source URL is a personal/project host rather than an official distribution channel like CurseForge or Modrinth, meaning there is no third-party verification layer. The JAR is a Java executable that gets installed to /usr/share/minecraft and will be loaded by the Minecraft client. This is a genuine supply-chain concern: a compromised masa.dy.fi server or MITM could substitute a malicious JAR with no checksum to catch it. That said, masa.dy.fi is the legitimate upstream distribution host for masa's mods (litematica, malilib, etc.) and this is not an obviously malicious pattern — it is sloppy packaging of a real mod. The medium rating is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: EatMyVenom <eat.my.venomm@gmail.com>
    
      2
    
      3_modname=litematica
    
      4_mcver="1.17-snapshot-21w05a"
    
      5_modloader="fabric"
    
      6pkgname=mc-litematica-117-fabric
    
      7pkgver="0.0.0.dev.20201218.030048"
    
      8pkgrel=1
    
      9pkgdesc="A new schematic mod written from scratch."
    
      10arch=('any')
    
      11url="https://masa.dy.fi/mcmods/client_mods/"
    
      12license=('LGPL')
    
      13makedepends=('wget' 'jq')
    
      14source=("manifest.json::https://masa.dy.fi/api/games/mods/minecraft/latest/client/")
    
      15sha1sums=('3b3c19c94ad38288f78222b4c72847f44df81b34')
    
      16
    
      17pkgver() {
    
      18  cd $srcdir
    
      19  cat manifest.json | jq ".[\"mods\"][\"${_mcver}\"][\"${_modloader}\"][\"${_modname}\"][\"version\"]" | sed 's/-/./g;s/+/./g'
    
      20}
    
      21
    
      22build() {
    
      23  wget $(cat manifest.json | jq -r ".[\"mods\"][\"${_mcver}\"][\"${_modloader}\"][\"${_modname}\"][\"url\"]")
    
      24}
    
      25
    
      26package() {
    
      27  install -d -m 755 "${pkgdir}/usr/share/minecraft"
    
      28
    
      29  cp $(cat manifest.json | jq -r ".[\"mods\"][\"${_mcver}\"][\"${_modloader}\"][\"${_modname}\"][\"filename\"]") \
    
      30     "${pkgdir}/usr/share/minecraft/${_modname}-${_mcver}.jar"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2