moonbridge-gui-bin

MEDIUM

maintainer micraow 0 votes scanned 2026-09-26 07:14:17.811062

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release by a relatively new maintainer with few votes, which constitutes a supply-chain risk due to the unverifiable nature of the binary artifact despite coming from a plausible project-owned source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release by a relatively new maintainer with few votes, which constitutes a supply-chain risk due to the unverifiable nature of the binary artifact despite coming from a plausible project-owned source.

PKGBUILD

      1# Maintainer: Micraow <15190450708 at 163 dot com>
    
      2pkgname=moonbridge-gui-bin
    
      3pkgver=0.1.4
    
      4pkgrel=1
    
      5pkgdesc="AI gateway desktop assistant for BUAA students - one-click bridge to Claude Code / Codex (binary release)"
    
      6arch=('x86_64')
    
      7url="https://github.com/Micraow/MoonBridge-Release"
    
      8license=('custom')
    
      9depends=('gtk3' 'webkit2gtk-4.1' 'libappindicator-gtk3')
    
      10provides=('moonbridge-gui')
    
      11conflicts=('moonbridge-gui' 'stuhelper-bin')
    
      12replaces=('stuhelper-bin')
    
      13options=('!strip')
    
      14source=("moonbridge-gui-${pkgver}.deb::https://github.com/Micraow/MoonBridge-Release/releases/download/v${pkgver}/StuHelper-v${pkgver}-linux.deb"
    
      15        "LICENSE")
    
      16sha256sums=('97741d8813e5b839fdc6d663bb906680ad84115031a6117d31e9468c7acdeaae'
    
      17            'a607afaac61dfc4a32e4d54b00eee51443bf34aa1b7f4fecf80750fdc25a4c22')
    
      18
    
      19package() {
    
      20    # makepkg 已把 .deb 解成 debian-binary / control.tar.gz / data.tar.gz，
    
      21    # 这里把 data 段的 FHS 布局原样铺进 $pkgdir
    
      22    bsdtar -xf "${srcdir}/data.tar.gz" -C "${pkgdir}"
    
      23    install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-26 07:14:17	Medium	2
2026-09-26 05:14:08	Medium	2