niri-scratchpad

maintainer Keithsel · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source is a single Python script fetched from a personal GitHub branch over raw.githubusercontent.com, which is not the official release location, and the package was recently orphaned and re-adopted, increasing supply-chain risk due to potential silent source replacement.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The source is a single Python script fetched from a personal GitHub branch over raw.githubusercontent.com, which is not the official release location, and the package was recently orphaned and re-adopted, increasing supply-chain risk due to potential silent source replacement.

PKGBUILD

      1# Maintainer: Keithsel <keithsel@disroot.org>
    
      2# Original author: Gabriel Volpe (gvolpe)
    
      3pkgname=niri-scratchpad
    
      4pkgver=0.0.3
    
      5pkgrel=1
    
      6pkgdesc='Scratchpad support for Niri: a scrollable-tiling Wayland compositor'
    
      7arch=('any')
    
      8url='https://github.com/gvolpe/niri-scratchpad'
    
      9license=('Apache-2.0')
    
      10depends=('python')
    
      11source=("nscratch::https://raw.githubusercontent.com/Keithsel/niri-scratchpad/shlex-spawn-command/src/ns.py"
    
      12         "LICENSE::https://raw.githubusercontent.com/Keithsel/niri-scratchpad/shlex-spawn-command/LICENSE")
    
      13sha256sums=('261712e7ffe6973af2e0146c4da90d780342c0a9e9d930378ff0d43d498eb960'
    
      14            'a8ad31b1c3f40dca5a84119351b8fa8ddc868edd77fad8a8ebf6d8f2d16fa4ae')
    
      15
    
      16package() {
    
      17    install -Dm755 nscratch "$pkgdir/usr/bin/nscratch"
    
      18    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      19}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2