pigma-bin

maintainer akirco · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from a GitHub release, which is a supply-chain risk due to unverifiable origin, but it is not actively malicious; the low severity is consistent with the flagged pattern of few votes and recent upload.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 85%): The package downloads a prebuilt binary from a GitHub release, which is a supply-chain risk due to unverifiable origin, but it is not actively malicious; the low severity is consistent with the flagged pattern of few votes and recent upload.

PKGBUILD

      1# Maintainer: akirco earlfx@163.com
    
      2pkgname=pigma-bin
    
      3_pkgname=pigma
    
      4pkgver=0.1.8
    
      5pkgrel=1
    
      6pkgdesc="A netease cloud music client"
    
      7arch=('x86_64')
    
      8url="https://github.com/akirco/pigma"
    
      9license=('Apache-2.0')
    
      10provides=("${_pkgname}")
    
      11conflicts=("${_pkgname}")
    
      12source=("${_pkgname}-${pkgver}.tar.gz::${url}/releases/download/v${pkgver}/${_pkgname}-x86_64-unknown-linux-gnu.tar.gz")
    
      13sha256sums=('SKIP')
    
      14
    
      15package() {
    
      16    install -Dm755 "${srcdir}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      17
    
      18    # install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      19}
    
      20

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 13:20:32	LOW	2