p-insurgence-bin

maintainer BrianAllred · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary archive (a Windows game executable intended to run under Wine) from p-insurgence.com, which is the official project website for Pokemon Insurgence. This is not a random personal host — it is the canonical distribution point for this fan game. However, the archive contains executed code (a Windows PE binary run via Wine), and the source is a single unofficial/fan-project host with no secondary verification (no GitHub releases, no checksums from an independent source). The sha256sums are present and hardcoded, which mitigates substitution risk somewhat, but if the domain were compromised or the maintainer updated the sums to match a malicious payload, users would execute arbitrary code via Wine. This is a genuine but low-probability supply-chain concern typical of AUR binary packages from single-source fan projects, warranting a MEDIUM rating rather than clean. There is no evidence of malice, obfuscation, or piracy of a commercial product (Pokemon Insurgence is a free fan game, not a cracked commercial title).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://p-insurgence.com/releases/${pkgver}/Pokemon%20Insurgence%20${pkgver}%20Core.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary archive (a Windows game executable intended to run under Wine) from p-insurgence.com, which is the official project website for Pokemon Insurgence. This is not a random personal host — it is the canonical distribution point for this fan game. However, the archive contains executed code (a Windows PE binary run via Wine), and the source is a single unofficial/fan-project host with no secondary verification (no GitHub releases, no checksums from an independent source). The sha256sums are present and hardcoded, which mitigates substitution risk somewhat, but if the domain were compromised or the maintainer updated the sums to match a malicious payload, users would execute arbitrary code via Wine. This is a genuine but low-probability supply-chain concern typical of AUR binary packages from single-source fan projects, warranting a MEDIUM rating rather than clean. There is no evidence of malice, obfuscation, or piracy of a commercial product (Pokemon Insurgence is a free fan game, not a cracked commercial title).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Brian Allred brian.d.allred<AT>gmail.com
    
      2
    
      3pkgname=p-insurgence-bin
    
      4pkgrel=1
    
      5pkgver=1.2.7
    
      6pkgdesc='Pokemon Insurgence is a fan game for the Pokemon series based in a new region with new mechanics'
    
      7arch=('any')
    
      8url='https://p-insurgence.com'
    
      9license=('none')
    
      10depends=('wine' 'sh')
    
      11options=('!strip')
    
      12source=("https://p-insurgence.com/releases/${pkgver}/Pokemon%20Insurgence%20${pkgver}%20Core.zip"
    
      13		"Insurgence.desktop"
    
      14        "p-insurgence.sh")
    
      15sha256sums=('1c7144958d92897e61a137b441029bd65dbfa44e705e977b85c1ac795956c2e3'
    
      16            '4888262200800ac9beadbfdd99da793f1163d79fe514d4ab30fb61f3ac412946'
    
      17            'e1745c4e01e95e7afcc7112329c40d3002dbdb41b054e9854a78551ed863b917')
    
      18
    
      19package() {
    
      20    # Move to directory
    
      21    mkdir -p "${pkgdir}/opt"
    
      22    mv "Pokemon Insurgence ${pkgver} Core" "${pkgdir}/opt/p-insurgence"
    
      23    chmod +x p-insurgence.sh
    
      24    cp p-insurgence.sh "${pkgdir}/opt/p-insurgence/p-insurgence.sh"
    
      25	
    
      26	# Link
    
      27    mkdir -p "${pkgdir}/usr/bin"
    
      28    mkdir -p "${pkgdir}/usr/share/applications"
    
      29	ln -s "/opt/p-insurgence/p-insurgence.sh" "${pkgdir}/usr/bin/p-insurgence"
    
      30	cp Insurgence.desktop "${pkgdir}/usr/share/applications/"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2