meshconv

maintainer bartus · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt x86_64 binary is downloaded directly from the upstream author's personal domain (patrickmin.com) and installed as an executable. There is no source code, no compilation step, and no way to verify what the binary actually does beyond the sha256 checksum. The checksum does pin a specific binary, which mitigates casual substitution, but the host is a personal site rather than an official distribution channel (e.g., GitHub releases, a distro mirror). This is a genuine supply-chain concern: if the binary at that URL were replaced, users would get arbitrary code execution. The pattern is common in AUR for closed-source or legacy tools, but it remains a real medium-severity risk — not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("http://www.patrickmin.com/meshconv/linux64/meshconv")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): A prebuilt x86_64 binary is downloaded directly from the upstream author's personal domain (patrickmin.com) and installed as an executable. There is no source code, no compilation step, and no way to verify what the binary actually does beyond the sha256 checksum. The checksum does pin a specific binary, which mitigates casual substitution, but the host is a personal site rather than an official distribution channel (e.g., GitHub releases, a distro mirror). This is a genuine supply-chain concern: if the binary at that URL were replaced, users would get arbitrary code execution. The pattern is common in AUR for closed-source or legacy tools, but it remains a real medium-severity risk — not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bartus <szczepaniak.bartek+aur@gmail.com>
    
      2
    
      3pkgname=meshconv
    
      4pkgver=1.29
    
      5pkgrel=1
    
      6pkgdesc="Converts to and from several popular 3D file formats"
    
      7url="https://www.patrickmin.com/meshconv/"
    
      8license=("GPL")
    
      9arch=('x86_64')
    
      10#depends=()
    
      11#groups=()
    
      12#makedepends=()
    
      13source=("http://www.patrickmin.com/meshconv/linux64/meshconv")
    
      14sha256sums=('50d1ce5dbedceb061289d7535ff62cfa81e7052b32241585a1e1c5b66ec4590d')
    
      15
    
      16package() {
    
      17  install -Dm755 ${pkgname} ${pkgdir}/usr/bin/${pkgname}
    
      18}
    
      19
    
      20

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2