mxpak-bin

maintainer GGOBP · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads a prebuilt escript (mxp) from a project-owned GitHub release, which is executed locally; while the host is not whitelisted, it is plausibly legitimate and the script is verified via checksum, but the low vote count and recent upload raise mild trust concerns.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt escript (mxp) from a project-owned GitHub release, which is executed locally; while the host is not whitelisted, it is plausibly legitimate and the script is verified via checksum, but the low vote count and recent upload raise mild trust concerns.

PKGBUILD

      1# Maintainer: GGOBP <GGOBP at protonmail dot ch>
    
      2
    
      3pkgname=mxpak-bin
    
      4pkgver=0.2.6
    
      5pkgrel=1
    
      6pkgdesc="Mendix widget .mpk package manager"
    
      7arch=('any')
    
      8url="https://github.com/glendix-labs/mxpak"
    
      9license=('MIT')
    
      10depends=('erlang-core' 'erlang-inets' 'erlang-ssl')
    
      11provides=("mxpak=$pkgver")
    
      12conflicts=('mxpak')
    
      13options=('!strip' '!debug')
    
      14source=(
    
      15  "mxp-$pkgver::$url/releases/download/v$pkgver/mxp"
    
      16  'LICENCE'
    
      17)
    
      18noextract=("mxp-$pkgver")
    
      19sha256sums=('0ca1dfac36f4c121f81597cbd61e4f9a2415e84b1f17cf933911c6d186ac398e' 'ca382295b2ca8d5f61f35f03a5274919dc3e84144325b5b9f0e0d16b274661b0')
    
      20
    
      21check() {
    
      22  escript "$srcdir/mxp-$pkgver" --version |
    
      23    grep -Fxq "mxpak v$pkgver"
    
      24}
    
      25
    
      26package() {
    
      27  install -Dm755 "$srcdir/mxp-$pkgver" "$pkgdir/usr/bin/mxp"
    
      28  install -Dm644 "$srcdir/LICENCE" \
    
      29    "$pkgdir/usr/share/licenses/$pkgname/LICENCE"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 05:22:53	LOW	2