muse-code-bin

MEDIUM

maintainer twilight0 0 votes scanned 2026-08-24 07:23:54.464908

View on AUR

Why flagged

Installs a prebuilt binary downloaded from lookaside.facebook.com (Meta's CDN), which is plausibly the project's official distribution host but is non-standard and unverifiable; the binary is executed directly, and while checksums are provided, the host is not a well-known official release infrastructure and the package has few votes/is recently uploaded, making supply-chain substitution a realistic concern.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source_x86_64=("${pkgname}-${pkgver}-x86_64::https://lookaside.facebook.com/lookaside/muse/download/?channel=muse&version=${_realver}&file=muse-x86-linux")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Installs a prebuilt binary downloaded from lookaside.facebook.com (Meta's CDN), which is plausibly the project's official distribution host but is non-standard and unverifiable; the binary is executed directly, and while checksums are provided, the host is not a well-known official release infrastructure and the package has few votes/is recently uploaded, making supply-chain substitution a realistic concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Twilight0 <twilight0@vivaldi.net>
    
      2
    
      3pkgname=muse-code-bin
    
      4_pkgname=muse
    
      5_realver="0.2.1-R1215.1"
    
      6pkgver=0.2.1.r1215.1
    
      7pkgrel=6
    
      8pkgdesc="Terminal-based AI coding agent powered by Meta's Muse Spark (dev.meta.ai)"
    
      9arch=('x86_64' 'aarch64')
    
      10url="https://dev.meta.ai"
    
      11license=('custom:Meta Model API Terms of Service')
    
      12depends=('ca-certificates')
    
      13optdepends=(
    
      14  'git: for workspace worktree isolation and version control operations'
    
      15  'qemu-user: to emulate AVX2 instructions on legacy CPUs (pre-Haswell)'
    
      16)
    
      17provides=('muse-code' 'musecode' 'muse-bin' 'musecode-bin')
    
      18conflicts=('muse-bin' 'musecode-bin' 'musecode')
    
      19options=('!strip')
    
      20
    
      21source=('muse.sh')
    
      22source_x86_64=("${pkgname}-${pkgver}-x86_64::https://lookaside.facebook.com/lookaside/muse/download/?channel=muse&version=${_realver}&file=muse-x86-linux")
    
      23source_aarch64=("${pkgname}-${pkgver}-aarch64::https://lookaside.facebook.com/lookaside/muse/download/?channel=muse&version=${_realver}&file=muse-aarch64-linux")
    
      24
    
      25sha256sums=('bca6241cec17194df6465c0ea0788653d660fc56ad1449e9527623d79671b5d5')
    
      26sha256sums_x86_64=('bfd8660b3a4fce67ab3287b0bd27ea64db1ee8472e8d7cb0f0f9aa8e083c9957')
    
      27sha256sums_aarch64=('f1088c112884153b8180809ef224e3775b740215dc9c566dff8c410992b75b1d')
    
      28
    
      29package() {
    
      30  install -Dm755 "${srcdir}/${pkgname}-${pkgver}-${CARCH}" "${pkgdir}/usr/lib/muse/muse"
    
      31  install -Dm755 "${srcdir}/muse.sh" "${pkgdir}/usr/bin/muse"
    
      32  ln -s muse "${pkgdir}/usr/bin/muse-code"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-24 07:23:54	Medium	3
2026-08-24 07:22:23	Medium	2