mmcli-bin

MEDIUM

maintainer rizukirr 0 votes scanned 2026-09-14 09:16:46.306722

View on AUR

Why flagged

The package downloads prebuilt binaries from a GitHub release, which is not inherently malicious, but the binaries are not built from source and come from a low-popularity project, creating a supply-chain risk if the source were compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads prebuilt binaries from a GitHub release, which is not inherently malicious, but the binaries are not built from source and come from a low-popularity project, creating a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: rizukirr <rizkirr.xyz@gmail.com>
    
      2pkgname=mmcli-bin
    
      3_pkgname=mmcli
    
      4pkgver=0.1.1
    
      5pkgrel=1
    
      6pkgdesc="A command-line YouTube downloader with built-in audio/video format conversion"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/rizukirr/mmcli"
    
      9license=('MIT')
    
      10depends=('ffmpeg' 'glibc' 'zlib')
    
      11provides=("$_pkgname")
    
      12conflicts=("$_pkgname")
    
      13options=('!strip' '!debug')
    
      14source=("LICENSE-$pkgver::https://raw.githubusercontent.com/rizukirr/mmcli/v$pkgver/LICENSE")
    
      15source_x86_64=("$_pkgname-$pkgver-x86_64::$url/releases/download/v$pkgver/$_pkgname-v$pkgver-linux-x86_64")
    
      16source_aarch64=("$_pkgname-$pkgver-aarch64::$url/releases/download/v$pkgver/$_pkgname-v$pkgver-linux-aarch64")
    
      17sha256sums=('53fc69e9f347afbeca2b180cc840698a56ebdcf7e3de944557ce5c04dcba7c66')
    
      18sha256sums_x86_64=('f6fff92b570521b4b7eac227e3ccbc85b79a3cb1375a15089986352e19de432e')
    
      19sha256sums_aarch64=('410a8ef052a7e0a23b44048a19c361f7ccfe16e8134ad2366779990530dd342c')
    
      20
    
      21package() {
    
      22	install -Dm755 "$_pkgname-$pkgver-$CARCH" "$pkgdir/usr/bin/$_pkgname"
    
      23	install -Dm644 "LICENSE-$pkgver" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-14 09:16:46	Medium	2