mcuviewer-bin

MEDIUM

maintainer kumen 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt binary (.deb) from a non-standard host (download.mcuviewer.com) which is not on the standard whitelist; the binary is then extracted and installed, posing a supply-chain risk if the host were compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=(${pkgname}_${pkgver}.zip::https://download.mcuviewer.com/releases/stable/1.3.0_13757d9/MCUViewer_Linux_${pkgver}.zip)

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary (.deb) from a non-standard host (download.mcuviewer.com) which is not on the standard whitelist; the binary is then extracted and installed, posing a supply-chain risk if the host were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kumen
    
      2
    
      3pkgname="mcuviewer-bin"
    
      4pkgver=1.3.0
    
      5pkgrel=1
    
      6pkgdesc="Real-time embedded variable & trace viewer "
    
      7arch=("x86_64")
    
      8depends=("libusb" "glfw" "gtk3" "glib2")
    
      9optdepends=('jlink-software-and-documentation' 'stlink' 'arm-none-eabi-gdb')
    
      10conflicts=('mcuviewer' 'mcuviewer-git')
    
      11provides=('mcuviewer')
    
      12url="https://mcuviewer.com"
    
      13license=('comercial')
    
      14options=(!strip)
    
      15
    
      16source=(${pkgname}_${pkgver}.zip::https://download.mcuviewer.com/releases/stable/1.3.0_13757d9/MCUViewer_Linux_${pkgver}.zip)
    
      17sha256sums=('ee6aba6b33343353ccd95f4f308053086f86fc6a675c089db867f8f679c61798')
    
      18
    
      19prepare()
    
      20{
    
      21  bsdtar xvf ${srcdir}/MCUViewer_Linux_${pkgver}/MCUViewer-${pkgver}-Linux.deb
    
      22}
    
      23
    
      24package()
    
      25{
    
      26  bsdtar xvf ${srcdir}/data.tar.gz -C "$pkgdir"
    
      27  cd "${srcdir}"
    
      28
    
      29  mkdir -p "${pkgdir}/usr/local/bin"
    
      30  ln -s /usr/local/MCUViewer/MCUViewer "${pkgdir}/usr/local/bin/"
    
      31}
    
      32
    
      33#
    
      34# makepkg --printsrcinfo > .SRCINFO
    
      35#
    
      36

Changes since previous scan

--- PKGBUILD @ 2026-10-20 00:10
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: kumen
 
 pkgname="mcuviewer-bin"
-pkgver=1.2.7
+pkgver=1.3.0
 pkgrel=1
 pkgdesc="Real-time embedded variable & trace viewer "
 arch=("x86_64")
@@ -13,8 +13,8 @@
 license=('comercial')
 options=(!strip)
 
-source=(${pkgname}_${pkgver}.zip::https://download.mcuviewer.com/releases/stable/1.2.7_fa2999b/MCUViewer_Linux_${pkgver}.zip)
-sha256sums=('844a6226e8a90522ef691287d9154960c0fea01db1300690e9833a3016f2c400')
+source=(${pkgname}_${pkgver}.zip::https://download.mcuviewer.com/releases/stable/1.3.0_13757d9/MCUViewer_Linux_${pkgver}.zip)
+sha256sums=('ee6aba6b33343353ccd95f4f308053086f86fc6a675c089db867f8f679c61798')
 
 prepare()
 {

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 15:28:05	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2