mirage-realms

maintainer qxb3 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary ZIP (Mirage-LinuxX64.zip) from the official upstream domain (miragerealms.co.uk) and installs it as an executable. The source host is the game's own website, not a personal or unofficial host, which reduces but does not eliminate risk. However, all three checksums are 'SKIP', meaning there is no integrity verification whatsoever — if the upstream host is compromised or the file changes, users would silently receive and execute arbitrary code. The binary is a closed-source game client executed directly on the user's system. This is a real supply-chain concern (no checksum pinning on an executed binary) but not clearly malicious, consistent with a medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 "https://www.miragerealms.co.uk/files/clients/legacy/Mirage-LinuxX64.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary ZIP (Mirage-LinuxX64.zip) from the official upstream domain (miragerealms.co.uk) and installs it as an executable. The source host is the game's own website, not a personal or unofficial host, which reduces but does not eliminate risk. However, all three checksums are 'SKIP', meaning there is no integrity verification whatsoever — if the upstream host is compromised or the file changes, users would silently receive and execute arbitrary code. The binary is a closed-source game client executed directly on the user's system. This is a real supply-chain concern (no checksum pinning on an executed binary) but not clearly malicious, consistent with a medium rating.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=mirage-realms
    
      2pkgver=1.0.0
    
      3pkgrel=1
    
      4pkgdesc="Free to play indie MMORPG for Android and PC"
    
      5arch=("x86_64")
    
      6url="https://www.miragerealms.co.uk"
    
      7license=("custom")
    
      8depends=("java-runtime>=11")
    
      9makedepends=("unzip")
    
      10source=(
    
      11  "https://www.miragerealms.co.uk/files/clients/legacy/Mirage-LinuxX64.zip"
    
      12  "mirage-realms.desktop"
    
      13  "https://www.miragerealms.co.uk/wp-content/uploads/2017/01/favicon.png"
    
      14)
    
      15sha256sums=("SKIP" "SKIP" "SKIP")
    
      16
    
      17package() {
    
      18  install -dm755 "$pkgdir/opt/$pkgname"
    
      19  unzip Mirage-LinuxX64.zip -d "$srcdir/_mr"
    
      20
    
      21  gamefolder="$(find "$srcdir/_mr" -mindepth 1 -maxdepth 1 -type d | head -n 1)"
    
      22  cp -r "$gamefolder"/* "$pkgdir/opt/$pkgname/"
    
      23
    
      24  chmod +x "$pkgdir/opt/$pkgname/Mirage Realms"
    
      25
    
      26  install -dm755 "$pkgdir/usr/bin"
    
      27  ln -s "/opt/$pkgname/Mirage Realms" "$pkgdir/usr/bin/mirage-realms"
    
      28
    
      29  install -Dm644 "$srcdir/mirage-realms.desktop" \
    
      30    "$pkgdir/usr/share/applications/mirage-realms.desktop"
    
      31
    
      32  install -Dm644 "$srcdir/favicon.png" \
    
      33    "$pkgdir/usr/share/pixmaps/mirage-realms.png"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2