paup-cli

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary executable (a Linux x86_64 ELF) directly from phylosolutions.com, which is the official vendor site for PAUP (Phylogenetic Analysis Using Parsimony). This is not an unofficial or personal host — it is the legitimate upstream distribution point for PAUP test builds. However, the package installs this binary directly without any source build, and uses only an MD5 checksum for integrity verification. MD5 is cryptographically broken and provides weak protection against a compromised or substituted binary. The URL uses plain HTTP (not HTTPS), meaning the download is also vulnerable to MITM substitution. The combination of: (1) a prebuilt binary installed to /usr/bin, (2) HTTP-only transport, and (3) MD5-only integrity check constitutes a genuine supply-chain risk even from an otherwise legitimate vendor host. This warrants a medium rating — not because the host is unofficial, but because the verification and transport mechanisms are insufficient for a directly-executed binary.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("http://phylosolutions.com/paup-test/$_execname.gz")

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary executable (a Linux x86_64 ELF) directly from phylosolutions.com, which is the official vendor site for PAUP (Phylogenetic Analysis Using Parsimony). This is not an unofficial or personal host — it is the legitimate upstream distribution point for PAUP test builds. However, the package installs this binary directly without any source build, and uses only an MD5 checksum for integrity verification. MD5 is cryptographically broken and provides weak protection against a compromised or substituted binary. The URL uses plain HTTP (not HTTPS), meaning the download is also vulnerable to MITM substitution. The combination of: (1) a prebuilt binary installed to /usr/bin, (2) HTTP-only transport, and (3) MD5-only integrity check constitutes a genuine supply-chain risk even from an otherwise legitimate vendor host. This warrants a medium rating — not because the host is unofficial, but because the verification and transport mechanisms are insufficient for a directly-executed binary.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ilya Elenskiy 
    
      2
    
      3pkgname=paup-cli
    
      4pkgver=4.0a168
    
      5_execname=paup${pkgver//.0/}_ubuntu64
    
      6pkgrel=1
    
      7pkgdesc="Phylogenetic Analysis Using PAUP"
    
      8arch=('i686' 'x86_64')
    
      9url="http://phylosolutions.com/paup-test/"
    
      10license=('custom')
    
      11depends=('python2' 'gcc-fortran')
    
      12source=("http://phylosolutions.com/paup-test/$_execname.gz")
    
      13md5sums=('a4a4f378cd5f8656664956180649d589')
    
      14
    
      15package() {
    
      16	install -Dm755 "$srcdir/$_execname" "$pkgdir/usr/bin/paup"
    
      17}
    
      18

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 01:12:32	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2