nirimod-git-bin

MEDIUM

maintainer eusouobn 0 votes scanned 2026-08-30 17:43:42.301716

View on AUR

Why flagged

The package downloads a prebuilt binary from a personal GitHub account not associated with the upstream project, creating a supply-chain risk if the release asset were silently replaced.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt binary from a personal GitHub account not associated with the upstream project, creating a supply-chain risk if the release asset were silently replaced.

PKGBUILD

      1# Maintainer: Bruno do Nascimento <eusouobn@gmail.com>
    
      2pkgname=nirimod-git-bin
    
      3pkgver=r92.7a449c8
    
      4pkgrel=1
    
      5pkgdesc="A visual, interactive configuration interface for the niri Wayland compositor (versão binária pré-compilada)"
    
      6arch=('any')
    
      7url="https://github.com/srinivasr/nirimod"
    
      8license=('MIT')
    
      9depends=(
    
      10  'gtk4'
    
      11  'libadwaita'
    
      12  'python'
    
      13  'python-gobject'
    
      14  'python-cairo'
    
      15  'hicolor-icon-theme'
    
      16  'niri'
    
      17)
    
      18provides=('nirimod')
    
      19conflicts=('nirimod' 'nirimod-git')
    
      20options=(!debug)
    
      21
    
      22source=("https://github.com/eusouobn/nirimod-bin-releases/releases/download/v${pkgver}/nirimod-full-${pkgver}-any.tar.gz")
    
      23sha256sums=('934ccf531a2dbc91761da05394524adbcb3a398a65c97bc4eb9850a5639da3ba')
    
      24
    
      25package() {
    
      26    cd "$srcdir"
    
      27    cp -a usr "$pkgdir/"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-30 17:43:42	Medium	2