muse-code-bin

LOW

maintainer twilight0 1 votes scanned 2026-10-08 00:28:03.132797

View on AUR

Why flagged

The binary is downloaded from lookaside.facebook.com, which hosts official Meta project assets; despite being a non-standard host, it is plausibly legitimate and the checksums are provided, reducing supply-chain risk for this prebuilt executable.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The binary is downloaded from lookaside.facebook.com, which hosts official Meta project assets; despite being a non-standard host, it is plausibly legitimate and the checksums are provided, reducing supply-chain risk for this prebuilt executable.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source_x86_64=("${pkgname}-${pkgver}-x86_64::https://lookaside.facebook.com/lookaside/muse/download/?channel=muse&version=${_realver}&file=muse-x86-linux")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Twilight0 <twilight0@vivaldi.net>
    
      2
    
      3pkgname=muse-code-bin
    
      4_pkgname=muse
    
      5_realver="1.4.0-R4302.1"
    
      6pkgver=1.4.0.r4302.1
    
      7pkgrel=1
    
      8pkgdesc="Terminal-based AI coding agent powered by Meta's Muse Spark (dev.meta.ai)"
    
      9arch=('x86_64' 'aarch64')
    
      10url="https://dev.meta.ai"
    
      11license=('custom:Meta Model API Terms of Service')
    
      12depends=('ca-certificates' 'python')
    
      13optdepends=(
    
      14  'git: for workspace worktree isolation and version control operations'
    
      15  'qemu-user: to emulate AVX2 instructions on legacy CPUs (pre-Haswell)'
    
      16)
    
      17provides=('muse-code' 'musecode' 'muse-bin' 'musecode-bin')
    
      18conflicts=('muse-bin' 'musecode-bin' 'musecode')
    
      19options=('!strip')
    
      20
    
      21source=('muse.sh' 'muse-session' 'muse-mcp')
    
      22source_x86_64=("${pkgname}-${pkgver}-x86_64::https://lookaside.facebook.com/lookaside/muse/download/?channel=muse&version=${_realver}&file=muse-x86-linux")
    
      23source_aarch64=("${pkgname}-${pkgver}-aarch64::https://lookaside.facebook.com/lookaside/muse/download/?channel=muse&version=${_realver}&file=muse-aarch64-linux")
    
      24
    
      25sha256sums=('76ad79c4a76a72369bf3cf1192392a21648081e6907d2fd3fdb6593ddc0c97a8' '2e37ab20bcbce1c5219164567d0e34ee09ddfc3cd761398855059d77af88f306' '3bc21891bd9ce78c2d244f1e66a04814398c2bdc8501e147ba7267efdb55bfc4')
    
      26sha256sums_x86_64=('ad21c22965f8600b4473b4ab8354ff7cc483d4cb681b46f2952561d855c8ed86')
    
      27sha256sums_aarch64=('79cfba1b9e417b370bdb9154a546c524b7f32a34026e6164b6f3f122f0ea3386')
    
      28
    
      29package() {
    
      30  install -Dm755 "${srcdir}/${pkgname}-${pkgver}-${CARCH}" "${pkgdir}/usr/lib/muse/muse"
    
      31  install -Dm755 "${srcdir}/muse.sh" "${pkgdir}/usr/bin/muse"
    
      32  install -Dm755 "${srcdir}/muse-session" "${pkgdir}/usr/lib/muse/muse-session"
    
      33  install -Dm755 "${srcdir}/muse-mcp" "${pkgdir}/usr/lib/muse/muse-mcp"
    
      34  ln -s muse "${pkgdir}/usr/bin/muse-code"
    
      35  ln -s /usr/lib/muse/muse-session "${pkgdir}/usr/bin/muse-session"
    
      36  ln -s /usr/lib/muse/muse-mcp "${pkgdir}/usr/bin/muse-mcp"
    
      37}
    
      38

Changes since previous scan

--- PKGBUILD @ 2026-10-05 23:40
+++ PKGBUILD @ 2026-10-08 00:28
@@ -2,8 +2,8 @@
 
 pkgname=muse-code-bin
 _pkgname=muse
-_realver="1.4.2-R4684.1"
-pkgver=1.4.2.r4684.1
+_realver="1.4.0-R4302.1"
+pkgver=1.4.0.r4302.1
 pkgrel=1
 pkgdesc="Terminal-based AI coding agent powered by Meta's Muse Spark (dev.meta.ai)"
 arch=('x86_64' 'aarch64')
@@ -23,8 +23,8 @@
 source_aarch64=("${pkgname}-${pkgver}-aarch64::https://lookaside.facebook.com/lookaside/muse/download/?channel=muse&version=${_realver}&file=muse-aarch64-linux")
 
 sha256sums=('76ad79c4a76a72369bf3cf1192392a21648081e6907d2fd3fdb6593ddc0c97a8' '2e37ab20bcbce1c5219164567d0e34ee09ddfc3cd761398855059d77af88f306' '3bc21891bd9ce78c2d244f1e66a04814398c2bdc8501e147ba7267efdb55bfc4')
-sha256sums_x86_64=('dfb3096c91f4767c4d98006460800b7ba906a0b1a408280a926a8dc19a1af64f')
-sha256sums_aarch64=('fa6974c23307a0d5db91367549e41505a5e7b55dcd66c672eb2dd89c1a125ad6')
+sha256sums_x86_64=('ad21c22965f8600b4473b4ab8354ff7cc483d4cb681b46f2952561d855c8ed86')
+sha256sums_aarch64=('79cfba1b9e417b370bdb9154a546c524b7f32a34026e6164b6f3f122f0ea3386')
 
 package() {
   install -Dm755 "${srcdir}/${pkgname}-${pkgver}-${CARCH}" "${pkgdir}/usr/lib/muse/muse"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 23:40:58	Medium	1
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 17:21:20	Medium	1
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 09:11:17	Medium	1
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2