opencode-beta

MEDIUM

maintainer thdxr 0 votes scanned 2026-09-08 01:15:25.605207

View on AUR

Why flagged

The package installs a prebuilt binary from npmjs.org, a trusted registry, but the binary is not built from source and could be replaced upstream without detection, representing a supply-chain risk despite the project being legitimate.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from npmjs.org, a trusted registry, but the binary is not built from source and could be replaced upstream without detection, representing a supply-chain risk despite the project being legitimate.

PKGBUILD

      1# Maintainer: Dax <mail@thdxr.com>
    
      2pkgname=opencode-beta
    
      3pkgver=0.0.0.beta.19271
    
      4pkgrel=1
    
      5pkgdesc='OpenCode V2 beta - the AI coding agent for the terminal'
    
      6url='https://github.com/anomalyco/opencode'
    
      7arch=('x86_64' 'aarch64')
    
      8license=('MIT')
    
      9depends=('glibc' 'gcc-libs' 'ripgrep')
    
      10provides=('opencode2')
    
      11conflicts=('opencode2')
    
      12options=('!strip' '!debug')
    
      13source=('LICENSE')
    
      14sha256sums=('625f0f619133f89bbbb2abe37369613dfa1885eba1e50d02170deb62bb42cb6b')
    
      15source_x86_64=('opencode-beta-0.0.0.beta.19271-x86_64.tgz::https://registry.npmjs.org/@opencode-ai/cli-linux-x64-baseline/-/cli-linux-x64-baseline-0.0.0-beta-19271.tgz')
    
      16sha256sums_x86_64=('0d0073742e8d53ff302befeb0a65e89fc9eb79289201664f6d99af6f77040eef')
    
      17source_aarch64=('opencode-beta-0.0.0.beta.19271-aarch64.tgz::https://registry.npmjs.org/@opencode-ai/cli-linux-arm64/-/cli-linux-arm64-0.0.0-beta-19271.tgz')
    
      18sha256sums_aarch64=('007c956f0a35a418067e796ef611c0d749e83b4395e5b0e5171b2df30473759b')
    
      19
    
      20package() {
    
      21  install -Dm755 "$srcdir/package/bin/opencode2" "$pkgdir/usr/bin/opencode2"
    
      22  install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-08 01:15:25	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 23:15:20	Medium	2