peekcam

maintainer sebszwolin777 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host (storage.googleapis.com) is Google's official MediaPipe model storage, and the downloaded .tflite file is a pure data/model file installed as a non-executed asset; the main source is from the project's own GitHub repo with a checksum; no obfuscation, exfiltration, or remote code execution is present, though the package is an untested draft with few votes.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The non-standard host (storage.googleapis.com) is Google's official MediaPipe model storage, and the downloaded .tflite file is a pure data/model file installed as a non-executed asset; the main source is from the project's own GitHub repo with a checksum; no obfuscation, exfiltration, or remote code execution is present, though the package is an untested draft with few votes.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 "selfie_segmenter.tflite::https://storage.googleapis.com/mediapipe-models/image_segmenter/selfie_segmenter/float16/latest/selfie_segmenter.tflite"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sebastian Zwolinski <szwolinski@startmail.com>
    
      2#
    
      3# UNTESTED DRAFT — build and validate on an Arch system before publishing to the AUR:
    
      4#   makepkg -si          # builds + installs; must succeed cleanly
    
      5#   namcap PKGBUILD      # lint the recipe
    
      6#   namcap peekcam-*.pkg.tar.zst   # lint the built package
    
      7# Then regenerate .SRCINFO with:  makepkg --printsrcinfo > .SRCINFO
    
      8pkgname=peekcam
    
      9pkgver=0.1.1
    
      10pkgrel=1
    
      11pkgdesc="Movable, always-on-top webcam overlay (shapes, v4l2 controls, snapshot, record, optional background blur)"
    
      12arch=('any')
    
      13url="https://github.com/sebszwolin777/peekcam"
    
      14license=('GPL-3.0-or-later')
    
      15depends=(
    
      16  'python'
    
      17  'python-pyqt6'
    
      18  'python-gobject'
    
      19  'gstreamer'
    
      20  'gst-plugins-base'
    
      21  'gst-plugins-good'
    
      22  'gst-plugins-bad'
    
      23  'v4l-utils'
    
      24)
    
      25optdepends=(
    
      26  'gst-plugins-ugly: H.264 recording via x264enc'
    
      27  'python-mediapipe-bin: background blur (prebuilt wheel; the source "python-mediapipe" AUR pkg fails to build)'
    
      28  'python-opencv: background blur'
    
      29  'python-numpy: background blur'
    
      30)
    
      31makedepends=('python-build' 'python-installer' 'python-wheel' 'python-setuptools')
    
      32source=(
    
      33  "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      34  "selfie_segmenter.tflite::https://storage.googleapis.com/mediapipe-models/image_segmenter/selfie_segmenter/float16/latest/selfie_segmenter.tflite"
    
      35)
    
      36sha256sums=(
    
      37  'ec7757a35ce908b48d517d5cb3ead1091992514792cb28a483234ad658d9ae7d'
    
      38  '191ac9529ae506ee0beefa6b2c945a172dab9d07d1e802a290a4e4038226658b'
    
      39)
    
      40
    
      41build() {
    
      42  cd "$pkgname-$pkgver"
    
      43  python -m build --wheel --no-isolation
    
      44}
    
      45
    
      46package() {
    
      47  cd "$pkgname-$pkgver"
    
      48
    
      49  # Python package + (unused) entry-point script; we replace the launcher below.
    
      50  python -m installer --destdir="$pkgdir" dist/*.whl
    
      51
    
      52  # App data: assets + segmentation model -> /usr/share/peekcam
    
      53  install -Dm644 assets/peekcam.png "$pkgdir/usr/share/peekcam/assets/peekcam.png"
    
      54  install -Dm644 "$srcdir/selfie_segmenter.tflite" \
    
      55    "$pkgdir/usr/share/peekcam/models/selfie_segmenter.tflite"
    
      56
    
      57  # Icons
    
      58  for sz in 48 64 128 256; do
    
      59    install -Dm644 "assets/peekcam-$sz.png" \
    
      60      "$pkgdir/usr/share/icons/hicolor/${sz}x${sz}/apps/peekcam.png"
    
      61  done
    
      62
    
      63  # Desktop entry + license
    
      64  install -Dm644 peekcam.desktop "$pkgdir/usr/share/applications/peekcam.desktop"
    
      65  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      66
    
      67  # Launcher: force the xcb platform (always-on-top needs X11/XWayland) and point the
    
      68  # app's data_dir() at the packaged /usr/share/peekcam. Overwrites the wheel's script.
    
      69  install -Dm755 /dev/stdin "$pkgdir/usr/bin/peekcam" <<'LAUNCH'
    
      70#!/bin/sh
    
      71export QT_QPA_PLATFORM="${QT_QPA_PLATFORM:-xcb}"
    
      72export PEEKCAM_DATA_DIR="${PEEKCAM_DATA_DIR:-/usr/share/peekcam}"
    
      73exec python -m peekcam "$@"
    
      74LAUNCH
    
      75}
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 01:19:05	LOW	3
2026-07-31 01:17:03	MEDIUM	2