mql

LOW

maintainer atomic111 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a source tarball from a project-owned domain (releases.mondoo.com) which is not on the standard whitelist but is plausibly official; the tarball contains a prebuilt binary, but given the domain's association with the project, the risk is low and the worst case is limited to supply chain compromise of an official release.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from a project-owned domain (releases.mondoo.com) which is not on the standard whitelist but is plausibly official; the tarball contains a prebuilt binary, but given the domain's association with the project, the risk is low and the worst case is limited to supply chain compromise of an official release.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://releases.mondoo.com/mql/${originalVersion}/mql_${originalVersion}_linux_amd64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mondoo Inc <hello@mondoo.com>
    
      2# Maintainer: Dominik Richter <dom@mondoo.com>
    
      3# Maintainer: Patrick Münch <patrick@mondoo.com>
    
      4#
    
      5pkgname=mql
    
      6originalVersion="14.9.1"
    
      7pkgver="${originalVersion/-/_}"
    
      8pkgrel=1
    
      9pkgdesc="Cloud-Native Query - Asset Inventory Framework"
    
      10url="https://mondoo.com"
    
      11license=('BUSL-1.1')
    
      12source=("https://releases.mondoo.com/mql/${originalVersion}/mql_${originalVersion}_linux_amd64.tar.gz"
    
      13    )
    
      14arch=('x86_64')
    
      15depends=()
    
      16conflicts=('cnquery')
    
      17replaces=('cnquery')
    
      18sha256sums=('2585505fb119fb38cebb6b038d7b039696336994164776bcd7734588c2ef3ee6'
    
      19            )
    
      20
    
      21
    
      22package() {
    
      23  install -dm755 ${pkgdir}/usr/bin
    
      24  cp ${srcdir}/$pkgname ${pkgdir}/usr/bin/.
    
      25
    
      26  
    
      27}
    
      28
    
      29#vim: syntax=sh

Changes since previous scan

--- PKGBUILD @ 2026-10-28 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -3,7 +3,7 @@
 # Maintainer: Patrick Münch <patrick@mondoo.com>
 #
 pkgname=mql
-originalVersion="14.8.0"
+originalVersion="14.9.1"
 pkgver="${originalVersion/-/_}"
 pkgrel=1
 pkgdesc="Cloud-Native Query - Asset Inventory Framework"
@@ -15,7 +15,7 @@
 depends=()
 conflicts=('cnquery')
 replaces=('cnquery')
-sha256sums=('4afaca4d757c6410fc360ca6c6add4418299eefb0631c1a5c6a8bd5c776119df'
+sha256sums=('2585505fb119fb38cebb6b038d7b039696336994164776bcd7734588c2ef3ee6'
             )
 
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 17:50:30	Medium	1
2026-10-28 00:06:54	Medium	2
2026-10-27 11:47:37	Medium	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 09:27:54	Medium	1
2026-10-20 00:10:31	Low	2
2026-10-19 09:25:06	Medium	1
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2