nsis-nsisunz-bin

maintainer Roboron · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source files from the official NSIS wiki, which is the project's legitimate host, despite the non-whitelisted domain; the files are DLL plugins for NSIS, not executable code built from untrusted sources, and the build process installs them directly without running any remote or obfuscated code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files from the official NSIS wiki, which is the project's legitimate host, despite the non-whitelisted domain; the files are DLL plugins for NSIS, not executable code built from untrusted sources, and the build process installs them directly without running any remote or obfuscated code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("Nsisunz-$pkgver.zip::https://nsis.sourceforge.io/mediawiki/images/1/1c/Nsisunz.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Roboron <robertoms258 at gmail dot com>
    
      2
    
      3pkgname=nsis-nsisunz-bin
    
      4pkgver=1.0
    
      5pkgrel=1
    
      6pkgdesc="NSIS plugin which allows you to extract files from ZIP archives"
    
      7arch=('any') # Does not contain any code that's executed on the host system
    
      8url="https://nsis.sourceforge.io/Nsisunz_plug-in"
    
      9license=('custom')
    
      10depends=('nsis')
    
      11source=("Nsisunz-$pkgver.zip::https://nsis.sourceforge.io/mediawiki/images/1/1c/Nsisunz.zip"
    
      12		"NsisunzU-$pkgver.zip::https://nsis.sourceforge.io/mediawiki/images/5/5a/NSISunzU.zip"
    
      13		'LICENSE')
    
      14sha256sums=('599029776df526def921ea178a6f66325b6f719772c38318e349a5c92a03afe9'
    
      15            '8c2b7ad6984e3137e4c51c763ec64cbd36364e72838b85e14fa287dac976c46b'
    
      16            '0945bd475c5ef7df1499f1157274f0eed63cedae29bacd6db3bc579b91668b74')
    
      17
    
      18package() {
    
      19  install -D "$srcdir"/nsisunz/Release/nsisunz.dll "$pkgdir"/usr/share/nsis/Plugins/x86-ansi/nsisunz.dll
    
      20  install -D "$srcdir"/NSISunzU/Plugin\ unicode/nsisunz.dll "$pkgdir"/usr/share/nsis/Plugins/x86-unicode/nsisunz.dll
    
      21  install -D "$srcdir"/LICENSE "$pkgdir"/usr/share/licenses/"$pkgname"/LICENSE
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2