org-cli

maintainer roantielemans · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary from a GitHub release tied to a recently orphaned and re-adopted AUR package, which increases supply-chain risk due to potential maintainer impersonation or repository takeover.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 80%): The package downloads a prebuilt binary from a GitHub release tied to a recently orphaned and re-adopted AUR package, which increases supply-chain risk due to potential maintainer impersonation or repository takeover.

PKGBUILD

      1# Maintainer: dcprevere
    
      2pkgname=org-cli
    
      3pkgver=0.1.2
    
      4pkgrel=1
    
      5pkgdesc='CLI for org-mode file manipulation and org-roam database management'
    
      6arch=('x86_64')
    
      7url='https://github.com/dcprevere/org-cli'
    
      8source=("${pkgname}-${pkgver}.tar.gz::${url}/releases/download/v${pkgver}/org-linux-x64.tar.gz")
    
      9sha256sums=('928a55ab9f732586cb21c3778e5b3cf6703c4fa7bed1ab896c77f114554e6938')
    
      10
    
      11package() {
    
      12    install -Dm755 "${srcdir}/org" "${pkgdir}/usr/bin/org"
    
      13}
    
      14

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0