nsis-cabx-bin

LOW

maintainer Roboron 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a plugin DLL for NSIS downloaded from the official NSIS wiki;虽 hosted on a non-whitelisted domain, it is part of the project's official documentation and release ecosystem, and the package only installs the DLL for use within NSIS, not executing arbitrary code on the host.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a plugin DLL for NSIS downloaded from the official NSIS wiki;虽 hosted on a non-whitelisted domain, it is part of the project's official documentation and release ecosystem, and the package only installs the DLL for use within NSIS, not executing arbitrary code on the host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("CabX-$pkgver.zip::https://nsis.sourceforge.io/mediawiki/images/c/c7/CabX.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Roboron <robertoms258 at gmail dot com>
    
      2
    
      3pkgname=nsis-cabx-bin
    
      4pkgver=1.0
    
      5pkgrel=1
    
      6pkgdesc="NSIS plugin which allows you to extract .cab files"
    
      7arch=('any') # Does not contain any code that's executed on the host system
    
      8url="https://nsis.sourceforge.io/CabX_plug-in"
    
      9license=('custom')
    
      10depends=('nsis')
    
      11source=("CabX-$pkgver.zip::https://nsis.sourceforge.io/mediawiki/images/c/c7/CabX.zip")
    
      12sha256sums=('5c42e0af34bc29d61dc8d84cb74f3e541e1133f9d35f147792e424503abd1fe6')
    
      13
    
      14package() {
    
      15  install -D "$srcdir"/Plugins/x86-unicode/CabX.dll "$pkgdir"/usr/share/nsis/Plugins/x86-unicode/CabX.dll
    
      16}
    
      17

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2