nsis-nsarray-bin

LOW

maintainer ciros 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a source archive from a project-related wiki page on sourceforge.io, which is plausibly the official project host; the content consists of header and plugin DLL files for NSIS, which are part of the normal build and install process for this plugin, and there is no evidence of malicious or obfuscated payloads.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source archive from a project-related wiki page on sourceforge.io, which is plausibly the official project host; the content consists of header and plugin DLL files for NSIS, which are part of the normal build and install process for this plugin, and there is no evidence of malicious or obfuscated payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("$_pkgname-$pkgver.zip::https://nsis.sourceforge.io/mediawiki/images/9/97/$_pkgname.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ciro Scognamiglio <ciro.scognamiglio88 at gmail dot com>
    
      2# Contributor: Ciro Scognamiglio <ciro.scognamiglio88 at gmail dot com>
    
      3
    
      4pkgname='nsis-nsarray-bin'
    
      5_pkgname='NsArray'
    
      6_pkgname2='nsArray'
    
      7pkgver='1.1.1.7'
    
      8pkgrel='2'
    
      9pkgdesc='Plug-in for NSIS which provides dynamic, indexed and associative arrays (much like PHP)'
    
      10arch=('any')
    
      11url="https://nsis.sourceforge.io/Arrays_in_NSIS"
    
      12license=('custom')
    
      13depends=('nsis')
    
      14source=("$_pkgname-$pkgver.zip::https://nsis.sourceforge.io/mediawiki/images/9/97/$_pkgname.zip")
    
      15sha256sums=('56cef303f97de3a6e26ccfe9a8a860bbb539a08c520d312e7774cce310013723')
    
      16
    
      17package() {
    
      18  install -Dm644 "$srcdir/Include/$_pkgname2.nsh" "$pkgdir/usr/share/nsis/Include/$_pkgname2.nsh"
    
      19  install -Dm644 "$srcdir/Plugins/x64-ansi/$_pkgname2.dll" "$pkgdir/usr/share/nsis/Plugins/amd64-ansi/$_pkgname2.dll"
    
      20  install -Dm644 "$srcdir/Plugins/x64-unicode/$_pkgname2.dll" "$pkgdir/usr/share/nsis/Plugins/amd64-unicode/$_pkgname2.dll"
    
      21  install -Dm644 "$srcdir/Plugins/x86-ansi/$_pkgname2.dll" "$pkgdir/usr/share/nsis/Plugins/x86-ansi/$_pkgname2.dll"
    
      22  install -Dm644 "$srcdir/Plugins/x86-unicode/$_pkgname2.dll" "$pkgdir/usr/share/nsis/Plugins/x86-unicode/$_pkgname2.dll"
    
      23}
    
      24

Changes since previous scan

--- PKGBUILD @ 2026-10-22 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -5,7 +5,7 @@
 _pkgname='NsArray'
 _pkgname2='nsArray'
 pkgver='1.1.1.7'
-pkgrel='1'
+pkgrel='2'
 pkgdesc='Plug-in for NSIS which provides dynamic, indexed and associative arrays (much like PHP)'
 arch=('any')
 url="https://nsis.sourceforge.io/Arrays_in_NSIS"
@@ -16,8 +16,8 @@
 
 package() {
   install -Dm644 "$srcdir/Include/$_pkgname2.nsh" "$pkgdir/usr/share/nsis/Include/$_pkgname2.nsh"
-  install -Dm644 "$srcdir/Plugins/x64-ansi/$_pkgname2.dll" "$pkgdir/usr/share/nsis/Plugins/x64-ansi/$_pkgname2.dll"
-  install -Dm644 "$srcdir/Plugins/x64-unicode/$_pkgname2.dll" "$pkgdir/usr/share/nsis/Plugins/x64-unicode/$_pkgname2.dll"
+  install -Dm644 "$srcdir/Plugins/x64-ansi/$_pkgname2.dll" "$pkgdir/usr/share/nsis/Plugins/amd64-ansi/$_pkgname2.dll"
+  install -Dm644 "$srcdir/Plugins/x64-unicode/$_pkgname2.dll" "$pkgdir/usr/share/nsis/Plugins/amd64-unicode/$_pkgname2.dll"
   install -Dm644 "$srcdir/Plugins/x86-ansi/$_pkgname2.dll" "$pkgdir/usr/share/nsis/Plugins/x86-ansi/$_pkgname2.dll"
   install -Dm644 "$srcdir/Plugins/x86-unicode/$_pkgname2.dll" "$pkgdir/usr/share/nsis/Plugins/x86-unicode/$_pkgname2.dll"
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 11:34:35	Medium	1
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2