mcuviewer-bin

maintainer kumen · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt proprietary binary from download.mcuviewer.com (the vendor's own download subdomain, not a personal/unofficial host) and installs it directly. The sha256sum is pinned, which provides integrity verification against tampering in transit. The host appears to be the official vendor distribution point for MCUViewer, an embedded debugging tool. However, the package installs an unverified closed-source binary (extracted from a .deb) with no GPG signature verification, and the binary runs with user privileges accessing USB devices. The risk is real but typical for proprietary binary AUR packages: if the vendor's download server were compromised or the maintainer updated the URL to a malicious host, users would execute arbitrary code. This is a standard medium-severity supply-chain concern for binary AUR packages from a proprietary vendor, not a false positive, but also not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=(${pkgname}_${pkgver}.zip::https://download.mcuviewer.com/releases/stable/1.2.7_fa2999b/MCUViewer_Linux_${pkgver}.zip)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt proprietary binary from download.mcuviewer.com (the vendor's own download subdomain, not a personal/unofficial host) and installs it directly. The sha256sum is pinned, which provides integrity verification against tampering in transit. The host appears to be the official vendor distribution point for MCUViewer, an embedded debugging tool. However, the package installs an unverified closed-source binary (extracted from a .deb) with no GPG signature verification, and the binary runs with user privileges accessing USB devices. The risk is real but typical for proprietary binary AUR packages: if the vendor's download server were compromised or the maintainer updated the URL to a malicious host, users would execute arbitrary code. This is a standard medium-severity supply-chain concern for binary AUR packages from a proprietary vendor, not a false positive, but also not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kumen
    
      2
    
      3pkgname="mcuviewer-bin"
    
      4pkgver=1.2.7
    
      5pkgrel=1
    
      6pkgdesc="Real-time embedded variable & trace viewer "
    
      7arch=("x86_64")
    
      8depends=("libusb" "glfw" "gtk3" "glib2")
    
      9optdepends=('jlink-software-and-documentation' 'stlink' 'arm-none-eabi-gdb')
    
      10conflicts=('mcuviewer' 'mcuviewer-git')
    
      11provides=('mcuviewer')
    
      12url="https://mcuviewer.com"
    
      13license=('comercial')
    
      14options=(!strip)
    
      15
    
      16source=(${pkgname}_${pkgver}.zip::https://download.mcuviewer.com/releases/stable/1.2.7_fa2999b/MCUViewer_Linux_${pkgver}.zip)
    
      17sha256sums=('844a6226e8a90522ef691287d9154960c0fea01db1300690e9833a3016f2c400')
    
      18
    
      19prepare()
    
      20{
    
      21  bsdtar xvf ${srcdir}/MCUViewer_Linux_${pkgver}/MCUViewer-${pkgver}-Linux.deb
    
      22}
    
      23
    
      24package()
    
      25{
    
      26  bsdtar xvf ${srcdir}/data.tar.gz -C "$pkgdir"
    
      27  cd "${srcdir}"
    
      28
    
      29  mkdir -p "${pkgdir}/usr/local/bin"
    
      30  ln -s /usr/local/MCUViewer/MCUViewer "${pkgdir}/usr/local/bin/"
    
      31}
    
      32
    
      33#
    
      34# makepkg --printsrcinfo > .SRCINFO
    
      35#
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2