php-browscap

maintainer orphaned · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and executes the Composer installer by piping curl output directly into PHP (curl -s https://getcomposer.org/installer | php) without any integrity verification. This is a well-known but genuinely risky pattern: a MITM attack or compromise of getcomposer.org could execute arbitrary code at build time. However, getcomposer.org is the official, legitimate Composer distribution host, and this bootstrap pattern is widely documented in Composer's own installation instructions. There is no obfuscation, no attacker-controlled host, no exfiltration, and no deliberate malicious intent visible. The risk is medium: sloppy security practice (should use --check or verify the installer hash as Composer's own docs recommend) rather than actual malware. The cheaper model's HIGH rating is a false positive on a known-legitimate but insecure pattern.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:25 curl -s https://getcomposer.org/installer | php

MEDIUM AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it MEDIUM (confidence 85%): The PKGBUILD downloads and executes the Composer installer by piping curl output directly into PHP (curl -s https://getcomposer.org/installer | php) without any integrity verification. This is a well-known but genuinely risky pattern: a MITM attack or compromise of getcomposer.org could execute arbitrary code at build time. However, getcomposer.org is the official, legitimate Composer distribution host, and this bootstrap pattern is widely documented in Composer's own installation instructions. There is no obfuscation, no attacker-controlled host, no exfiltration, and no deliberate malicious intent visible. The risk is medium: sloppy security practice (should use --check or verify the installer hash as Composer's own docs recommend) rather than actual malware. The cheaper model's HIGH rating is a false positive on a known-legitimate but insecure pattern.

1 higher static finding superseded - not the current verdict (shown for transparency)

HIGH Remote download executed by a shell curl_pipe_shell

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

PKGBUILD:25 curl -s https://getcomposer.org/installer | php

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alex "grevus" Lobtsov <alex@lobtsov.com>
    
      2pkgname=php-browscap
    
      3pkgver=6.1.0
    
      4pkgrel=1
    
      5pkgdesc="PHP browscap"
    
      6url="http://browscap.org/"
    
      7arch=('x86_64' 'i686')
    
      8license=('PHP')
    
      9depends=(
    
      10    'php'
    
      11    'curl'
    
      12)
    
      13backup=(
    
      14    'etc/php/conf.d/browscap.ini'
    
      15    'etc/php/extra/browscap.ini'
    
      16)
    
      17
    
      18source=(
    
      19    https://github.com/browscap/browscap/archive/${pkgver}.tar.gz
    
      20    browscap.conf.ini
    
      21)
    
      22
    
      23build() {
    
      24  cd "browscap-$pkgver"
    
      25  curl -s https://getcomposer.org/installer | php
    
      26  php composer.phar install
    
      27  bin/browscap build ${pkgver}
    
      28}
    
      29
    
      30package() {
    
      31  cd "browscap-$pkgver"
    
      32  install -Dm644 build/full_php_browscap.ini "$pkgdir/etc/php/extra/browscap.ini"
    
      33  install -Dm644 ${srcdir}/browscap.conf.ini "$pkgdir/etc/php/conf.d/browscap.ini"
    
      34}
    
      35
    
      36sha256sums=('1d8e7391e6bba2bbd010370a6aea80a0c4e3d7b24f4a8cf287f49677fe51be7c'
    
      37            'ab973c3fd8d4842430f70d144278c150061b6e2ff77d7b367f9921fa728ad169')
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3