pacterm

maintainer waelma · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt binary is downloaded from a personal/non-official host (wael.work.gd) with no source code, no build step, and installed directly as an executable; while a checksum is provided, the host is a personal domain where the binary could be silently swapped, making this an unverifiable prebuilt from an untrusted source.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("pacterm-${pkgver}::https://wael.work.gd/arch/pacterm/bin/${pkgver}/pacterm")

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 80%): A prebuilt binary is downloaded from a personal/non-official host (wael.work.gd) with no source code, no build step, and installed directly as an executable; while a checksum is provided, the host is a personal domain where the binary could be silently swapped, making this an unverifiable prebuilt from an untrusted source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Wael Amrani Zerrifi <waelaz1983@gmail.com>
    
      2pkgname=pacterm
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="A terminal pacman game by Wael"
    
      6arch=('x86_64')
    
      7url="https://wael.work.gd/arch/pacterm"
    
      8license=('GPL3')
    
      9source=("pacterm-${pkgver}::https://wael.work.gd/arch/pacterm/bin/${pkgver}/pacterm")
    
      10sha256sums=('4ffee88263f63bfb2015faf06ce84cae314d6359d120a4f34c0b3766fef9ee9b')
    
      11options=('!strip' '!debug')
    
      12
    
      13package() {
    
      14    install -Dm755 "${srcdir}/pacterm-${pkgver}" "${pkgdir}/usr/bin/pacterm"
    
      15}
    
      16

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 13:41:04	MEDIUM	3
2026-07-28 13:38:59	MEDIUM	3