nym-vpnd-bin
MEDIUM
maintainer nym
4 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package installs a setuid binary (nym-exclude) which grants elevated privileges, creating a potential security risk if the binary is compromised or misused.
Triggered rules
Medium
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:27
chmod u+s "$pkgdir/usr/bin/nym-exclude"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a setuid binary (nym-exclude) which grants elevated privileges, creating a potential security risk if the binary is compromised or misused.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Nym <ops@nymte.ch>
2
# Maintainer: Andrej Mihajlov <andrej@nymtech.net>
3
# Maintainer: Lawrence Stalder <lawrence.stalder@pm.me>
4
# Contributor: Pierre Dommerc <pierre@nymtech.net>
5
6
pkgname=nym-vpnd-bin
7
pkgver=2026.12.4
8
pkgrel=1
9
pkgdesc='NymVPN daemon as a systemd service'
10
arch=('x86_64' 'aarch64')
11
url='https://github.com/nymtech/nym-vpn-client'
12
license=('GPL-3.0-only')
13
depends=('glibc' 'gcc-libs' 'dbus' 'libmnl' 'libnftnl' 'polkit')
14
makedepends=()
15
provides=('nym-vpnd' 'nym-exclude' 'nym-socks5-proxy')
16
conflicts=('nym-vpnd')
17
options=(!debug)
18
source_x86_64=("$url/releases/download/nym-vpn-v2026.12.4/nym-vpn-core-v2026.12.4_linux_x86_64.tar.gz" 'nym-vpnd.service' 'nym-vpn.conf')
19
source_aarch64=("$url/releases/download/nym-vpn-v2026.12.4/nym-vpn-core-v2026.12.4_linux_aarch64.tar.gz" 'nym-vpnd.service' 'nym-vpn.conf')
20
sha256sums_x86_64=(17ec7c1d41395328aada6a71633ba11c9a152960d836f00ba6a9792fb0aa76a4 66d5b043cbef2ae0ba19cc7685c7b42808515b8b520b0dd15a0c313ca039f6d6 af03cbdb98708e60038d784503d99f382595f3a1e020fea41d5c2cc5800de319)
21
sha256sums_aarch64=(cca9b7bf98aab43d481b5a3ad0098300ee08e3d2e11497b423a71457ab8b565a 66d5b043cbef2ae0ba19cc7685c7b42808515b8b520b0dd15a0c313ca039f6d6 af03cbdb98708e60038d784503d99f382595f3a1e020fea41d5c2cc5800de319)
22
23
package() {
24
pushd "nym-vpn-core-v2026.12.4_linux_${CARCH}"
25
install -Dm755 "nym-vpnd" "$pkgdir/usr/bin/nym-vpnd"
26
install -Dm755 "nym-exclude" "$pkgdir/usr/bin/nym-exclude"
27
chmod u+s "$pkgdir/usr/bin/nym-exclude"
28
install -Dm755 "nym-socks5-proxy" "$pkgdir/usr/bin/nym-socks5-proxy"
29
popd
30
31
install -Dm644 nym-vpnd.service "$pkgdir/usr/lib/systemd/system/nym-vpnd.service"
32
install -Dm644 nym-vpn.conf "$pkgdir/usr/lib/sysusers.d/nym-vpn.conf"
33
}
34
Changes since previous scan
--- PKGBUILD @ 2026-09-16 00:03+++ PKGBUILD @ 2026-09-17 00:27@@ -4,7 +4,7 @@ # Contributor: Pierre Dommerc <pierre@nymtech.net> pkgname=nym-vpnd-bin-pkgver=2026.12.1+pkgver=2026.12.4 pkgrel=1 pkgdesc='NymVPN daemon as a systemd service' arch=('x86_64' 'aarch64')@@ -15,13 +15,13 @@ provides=('nym-vpnd' 'nym-exclude' 'nym-socks5-proxy') conflicts=('nym-vpnd') options=(!debug)-source_x86_64=("$url/releases/download/nym-vpn-v2026.12.1/nym-vpn-core-v2026.12.1_linux_x86_64.tar.gz" 'nym-vpnd.service' 'nym-vpn.conf')-source_aarch64=("$url/releases/download/nym-vpn-v2026.12.1/nym-vpn-core-v2026.12.1_linux_aarch64.tar.gz" 'nym-vpnd.service' 'nym-vpn.conf')-sha256sums_x86_64=(74ede0d911ec624de57584f93fce98f442a173112aa4ba5b655c8422e99b2140 66d5b043cbef2ae0ba19cc7685c7b42808515b8b520b0dd15a0c313ca039f6d6 af03cbdb98708e60038d784503d99f382595f3a1e020fea41d5c2cc5800de319)-sha256sums_aarch64=(8f29713555466e03881089629b2ade4f95e09e5c724a0811493d53380ca0e6fc 66d5b043cbef2ae0ba19cc7685c7b42808515b8b520b0dd15a0c313ca039f6d6 af03cbdb98708e60038d784503d99f382595f3a1e020fea41d5c2cc5800de319)+source_x86_64=("$url/releases/download/nym-vpn-v2026.12.4/nym-vpn-core-v2026.12.4_linux_x86_64.tar.gz" 'nym-vpnd.service' 'nym-vpn.conf')+source_aarch64=("$url/releases/download/nym-vpn-v2026.12.4/nym-vpn-core-v2026.12.4_linux_aarch64.tar.gz" 'nym-vpnd.service' 'nym-vpn.conf')+sha256sums_x86_64=(17ec7c1d41395328aada6a71633ba11c9a152960d836f00ba6a9792fb0aa76a4 66d5b043cbef2ae0ba19cc7685c7b42808515b8b520b0dd15a0c313ca039f6d6 af03cbdb98708e60038d784503d99f382595f3a1e020fea41d5c2cc5800de319)+sha256sums_aarch64=(cca9b7bf98aab43d481b5a3ad0098300ee08e3d2e11497b423a71457ab8b565a 66d5b043cbef2ae0ba19cc7685c7b42808515b8b520b0dd15a0c313ca039f6d6 af03cbdb98708e60038d784503d99f382595f3a1e020fea41d5c2cc5800de319) package() {- pushd "nym-vpn-core-v2026.12.1_linux_${CARCH}"+ pushd "nym-vpn-core-v2026.12.4_linux_${CARCH}" install -Dm755 "nym-vpnd" "$pkgdir/usr/bin/nym-vpnd" install -Dm755 "nym-exclude" "$pkgdir/usr/bin/nym-exclude" chmod u+s "$pkgdir/usr/bin/nym-exclude"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 15:22:50 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |