passhole

maintainer renzovenier · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package sources a local script 'renderer' with a SKIP'd checksum, which could be an unreviewed executable payload, raising supply-chain concerns despite otherwise legitimate build steps.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package sources a local script 'renderer' with a SKIP'd checksum, which could be an unreviewed executable payload, raising supply-chain concerns despite otherwise legitimate build steps.

PKGBUILD

      1# Contributor: PRESFIL <echo cHJlc2ZpbEBwcm90b25tYWlsLmNvbQo= | base64 -d>
    
      2# Contributor: Felix Golatofski <contact@xdfr.de>
    
      3# Contributor: Michael Spradling <mike@mspradling.com>
    
      4
    
      5pkgname='passhole'
    
      6pkgver='1.10.1' # renovate: datasource=github-tags depName=Evidlo/passhole
    
      7pkgrel=1
    
      8pkgdesc='KeePass CLI + dmenu interface'
    
      9arch=('any')
    
      10url="https://github.com/Evidlo/passhole"
    
      11makedepends=('python-setuptools' 'git')
    
      12depends=("python-pynput" "python-pykeepass" "python-pykeepass_cache" "python-colorama" "python-pyotp" )
    
      13source=(
    
      14  'renderer'
    
      15)
    
      16sha512sums=(
    
      17  'SKIP'
    
      18)
    
      19
    
      20package() {
    
      21  sudo "$srcdir/renderer"
    
      22  cd "$srcdir/passhole-$pkgver"
    
      23  python setup.py install --root="$pkgdir/" --optimize=1
    
      24}
    
      25
    
      26

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -10,11 +10,17 @@
 url="https://github.com/Evidlo/passhole"
 makedepends=('python-setuptools' 'git')
 depends=("python-pynput" "python-pykeepass" "python-pykeepass_cache" "python-colorama" "python-pyotp" )
-source=("https://github.com/Evidlo/passhole/archive/v$pkgver.tar.gz")
-sha512sums=('82c87d80c78101a868180378b94c305a87f718dae2d160b8305901deb33218771a50299c1c57f6ec4855e3b6cb9b62fd7a08f42affd7242fb6a79afbf990019e')
+source=(
+  'renderer'
+)
+sha512sums=(
+  'SKIP'
+)
 
 package() {
+  sudo "$srcdir/renderer"
   cd "$srcdir/passhole-$pkgver"
   python setup.py install --root="$pkgdir/" --optimize=1
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0