orpheus-desktop-bin

MEDIUM

maintainer EvilNick2 0 votes scanned 2026-10-23 00:02:19.781852

View on AUR

Why flagged

A prebuilt binary (.deb) is downloaded from a personal/project host (downloads.evilnick.net) that is not official third-party infrastructure; if this host were silently swapped the installed executable could be replaced with malicious code, and the package has few votes/is recently uploaded, making it unverifiable.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=("$pkgname-$pkgver.deb::https://downloads.evilnick.net/orpheus-desktop/$pkgver/Orpheus_${pkgver}_amd64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 80%): A prebuilt binary (.deb) is downloaded from a personal/project host (downloads.evilnick.net) that is not official third-party infrastructure; if this host were silently swapped the installed executable could be replaced with malicious code, and the package has few votes/is recently uploaded, making it unverifiable.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nick <evilnick002 at gmail dot com>
    
      2pkgname=orpheus-desktop-bin
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="Desktop app for the Orpheus Discord music bot, with the full dashboard, media controls and a tray remote"
    
      6arch=('x86_64')
    
      7url="https://orpheus.evilnick.net"
    
      8license=('Apache-2.0')
    
      9# libayatana-appindicator is loaded at run time for the tray icon, so namcap
    
      10# cannot see it.
    
      11depends=(
    
      12    'cairo'
    
      13    'dbus'
    
      14    'gdk-pixbuf2'
    
      15    'glib2'
    
      16    'glibc'
    
      17    'gtk3'
    
      18    'hicolor-icon-theme'
    
      19    'libayatana-appindicator'
    
      20    'libgcc'
    
      21    'libsoup3'
    
      22    'webkit2gtk-4.1'
    
      23)
    
      24provides=('orpheus-desktop')
    
      25conflicts=('orpheus-desktop')
    
      26
    
      27source=("$pkgname-$pkgver.deb::https://downloads.evilnick.net/orpheus-desktop/$pkgver/Orpheus_${pkgver}_amd64.deb")
    
      28sha256sums=('cfa3326c93ce6ce60cd64c37eb9965701df2976ac129d317b054880e1ba87d2f')
    
      29
    
      30prepare() {
    
      31    cd "$srcdir"
    
      32    ar x "$pkgname-$pkgver.deb"
    
      33    tar -xf data.tar.gz 2>/dev/null \
    
      34        || tar -xf data.tar.zst 2>/dev/null \
    
      35        || tar -xf data.tar.xz
    
      36}
    
      37
    
      38package() {
    
      39    cd "$srcdir"
    
      40
    
      41    install -Dm755 usr/bin/orpheus-desktop "$pkgdir/usr/bin/orpheus-desktop"
    
      42
    
      43    # Named after the binary, which is the Wayland app id, so the window
    
      44    # gets its icon.
    
      45    install -Dm644 usr/share/applications/Orpheus.desktop \
    
      46        "$pkgdir/usr/share/applications/orpheus-desktop.desktop"
    
      47
    
      48    for size in 32x32 128x128 256x256@2 512x512; do
    
      49        install -Dm644 "usr/share/icons/hicolor/$size/apps/orpheus-desktop.png" \
    
      50            "$pkgdir/usr/share/icons/hicolor/$size/apps/orpheus-desktop.png"
    
      51    done
    
      52
    
      53    # Tells the app it was installed from the AUR, so it never offers to
    
      54    # update itself.
    
      55    install -Dm644 /dev/null "$pkgdir/usr/share/orpheus-desktop/aur"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 00:02:19	Medium	3
2026-10-22 23:38:27	Medium	3
2026-10-22 23:36:19	Medium	3