neowall-bin

maintainer 0xBAAAAAAD · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release without a verifiable checksum for the LICENSE file and has a SKIP'd checksum, increasing supply-chain risk despite otherwise legitimate sources.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release without a verifiable checksum for the LICENSE file and has a SKIP'd checksum, increasing supply-chain risk despite otherwise legitimate sources.

PKGBUILD

      1# Maintainer: 1ay1 <https://github.com/1ay1>
    
      2# Generated automatically by .github/workflows/release.yml — do not edit by hand.
    
      3pkgname=neowall-bin
    
      4pkgver=0.5.5
    
      5pkgrel=1
    
      6pkgdesc="GPU shader wallpapers for Wayland and X11 (prebuilt binary)"
    
      7arch=('x86_64')
    
      8url="https://github.com/1ay1/neowall"
    
      9license=('MIT')
    
      10depends=('wayland' 'mesa' 'libpng' 'libjpeg-turbo' 'libx11' 'libxrandr' 'libxkbcommon')
    
      11provides=('neowall')
    
      12conflicts=('neowall' 'neowall-git')
    
      13options=(!strip !debug)
    
      14source=("neowall-$pkgver-x86_64.tar.gz::https://github.com/1ay1/neowall/releases/download/v0.5.5/neowall-linux-x86_64-arch.tar.gz"
    
      15        "LICENSE-$pkgver::https://raw.githubusercontent.com/1ay1/neowall/v0.5.5/LICENSE")
    
      16sha256sums=('52aababa5d40e39a4c544e26aaf77e535d829c2af782ca7461b8501c72399a8d'
    
      17            'SKIP')
    
      18
    
      19package() {
    
      20  install -Dm755 "$srcdir/neowall" "$pkgdir/usr/bin/neowall"
    
      21  install -Dm644 "$srcdir/LICENSE-$pkgver" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 09:34:56	MEDIUM	2