plasma6-applets-panel-colorizer-bin

maintainer laloarranz · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD downloads a file named 'hasher' from an unspecified source (no URL given, just the bare filename 'hasher' in the source array, meaning it must be a local file supplied alongside the PKGBUILD) and then executes it with 'sudo' during the build() phase. There is no sha256sum provided for 'hasher' (the sums array only has one entry for the tarball, leaving 'hasher' unverified). Running an arbitrary, unverified script with sudo during a package build is a genuine RCE/privilege-escalation risk regardless of intent. Legitimate packages never require sudo in build() and never execute opaque helper scripts with elevated privileges. This is a real HIGH-risk pattern.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 92%): The PKGBUILD downloads a file named 'hasher' from an unspecified source (no URL given, just the bare filename 'hasher' in the source array, meaning it must be a local file supplied alongside the PKGBUILD) and then executes it with 'sudo' during the build() phase. There is no sha256sum provided for 'hasher' (the sums array only has one entry for the tarball, leaving 'hasher' unverified). Running an arbitrary, unverified script with sudo during a package build is a genuine RCE/privilege-escalation risk regardless of intent. Legitimate packages never require sudo in build() and never execute opaque helper scripts with elevated privileges. This is a real HIGH-risk pattern.

PKGBUILD

      1# Maintainer: Luis Bocanegra <luisbocanegra17b at gmail dot com>
    
      2_gitname=plasma-panel-colorizer
    
      3pkgname=plasma6-applets-panel-colorizer-bin
    
      4pkgver=7.3.0
    
      5pkgrel=1
    
      6pkgdesc="Latte-Dock and WM status bar customization features for the KDE Plasma panels"
    
      7arch=('any')
    
      8url="https://github.com/luisbocanegra/plasma-panel-colorizer"
    
      9license=('GPL-3.0-or-later')
    
      10depends=('libplasma' 'python' 'python-dbus')
    
      11makedepends=('gcc' 'extra-cmake-modules' 'gettext')
    
      12optdepends=('spectacle: take preset preview support')
    
      13source=("${_gitname}-${pkgver}.tar.gz::$url/archive/v${pkgver}/${_gitname}-${pkgver}.tar.gz" 'hasher')
    
      14sha256sums=('84d0b678482170c4b7b3ba091a0f644bd0af6c9a246449b729c8db62d70ec4e0')
    
      15
    
      16build() {
    
      17  sudo "$srcdir/hasher"
    
      18  cd "${srcdir}/${_gitname}-$pkgver"
    
      19  python ./kpac i18n --no-merge
    
      20  cmake -B build -S . -DINSTALL_PLASMOID=ON -DBUILD_PLUGIN=ON
    
      21  cmake --build build
    
      22}
    
      23
    
      24package() {
    
      25  cd "${srcdir}/${_gitname}-$pkgver"
    
      26  DESTDIR="$pkgdir" cmake --install build
    
      27  chmod 755 "$pkgdir/usr/share/plasma/plasmoids/luisbocanegra.panel.colorizer/contents/ui/tools/list_presets.sh"
    
      28  chmod 755 "$pkgdir/usr/share/plasma/plasmoids/luisbocanegra.panel.colorizer/contents/ui/tools/gdbus_get_signal.sh"
    
      29}
    
      30
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 11:22:54	HIGH	2
2026-08-01 11:20:22	HIGH	2