plutonium-launcher-bin

maintainer MightyElemental · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt Windows executable (plutonium.exe) from the project's own CDN (cdn.plutonium.pw), which is plausibly the official source; while the host is not on a standard whitelist, it belongs to the project's domain, and the worst case of a swapped binary would be code execution in Wine, but this is expected behavior for a game launcher and not inherently malicious in context.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Windows executable (plutonium.exe) from the project's own CDN (cdn.plutonium.pw), which is plausibly the official source; while the host is not on a standard whitelist, it belongs to the project's domain, and the worst case of a swapped binary would be code execution in Wine, but this is expected behavior for a game launcher and not inherently malicious in context.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 "plutonium.exe::https://cdn.plutonium.pw/updater/plutonium.exe"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: MightyElemental <https://github.com/mightyelemental>
    
      2pkgname=plutonium-launcher-bin
    
      3pkgver=1
    
      4pkgrel=1
    
      5pkgdesc="Plutonium launcher (BO2/BO1/MW3/WaW mod client) with Arch-friendly Wine/DXVK setup"
    
      6arch=('x86_64')
    
      7url="https://plutonium.pw/"
    
      8license=('custom')
    
      9depends=(
    
      10  'wine'
    
      11  'winetricks'
    
      12  'dxvk-bin'
    
      13  'vulkan-icd-loader'
    
      14  'lib32-vulkan-icd-loader'
    
      15  'xorg-xrandr'   # common runtime need for Wine games
    
      16)
    
      17optdepends=(
    
      18  'zenity: show a GUI progress dialog on first-time setup'
    
      19  'nvidia-utils: NVIDIA Vulkan driver'
    
      20  'lib32-nvidia-utils: NVIDIA 32-bit Vulkan driver'
    
      21  'mesa: AMD/Intel OpenGL/Vulkan'
    
      22  'lib32-mesa: AMD/Intel 32-bit OpenGL/Vulkan'
    
      23)
    
      24provides=('plutonium-launcher')
    
      25conflicts=('plutonium-launcher')
    
      26install=plutonium-launcher-bin.install
    
      27source=(
    
      28  "plutonium.exe::https://cdn.plutonium.pw/updater/plutonium.exe"
    
      29  "plutonium"
    
      30  "plutonium.desktop"
    
      31  "plutonium-icon.svg"
    
      32  "plutonium-launcher-bin.install"
    
      33  "LICENSE.plutonium"
    
      34)
    
      35sha256sums=('SKIP'
    
      36            'b56bec04dbc664e870042df4be4cc480eb144dea1ef6a0c3eda557732ec06121'
    
      37            'ef1458b11f9999455205fe0b561a55536dbb292f84e2ffd7590b4da4fc54b291'
    
      38            '18cf3f3037a077b2bff29dbf97c64eabf885f35dd390478d1ef103540e025ace'
    
      39            '17a98e4ae6315d59e1e99afc653375570d9e5d2be6b6c66ca8f293737b7e180d'
    
      40            '9142767d9a4f3231de8055498f187605d575828c50e9e0a443c6991e3c797000')
    
      41
    
      42package() {
    
      43  install -d "$pkgdir/opt/plutonium" \
    
      44             "$pkgdir/usr/bin" \
    
      45             "$pkgdir/usr/share/applications" \
    
      46             "$pkgdir/usr/share/licenses/$pkgname"
    
      47
    
      48  # launcher exe
    
      49  install -m644 "$srcdir/plutonium.exe" "$pkgdir/opt/plutonium/plutonium.exe"
    
      50
    
      51  # wrapper script
    
      52  install -m755 "$srcdir/plutonium" "$pkgdir/usr/bin/plutonium-launcher"
    
      53
    
      54  # desktop entry
    
      55  install -m644 "$srcdir/plutonium.desktop" "$pkgdir/usr/share/applications/plutonium.desktop"
    
      56
    
      57  # icon (SVG, scalable)
    
      58  install -Dm644 "$srcdir/plutonium-icon.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/plutonium.svg"
    
      59
    
      60  # license stub (project is freeware/3rd party; provide upstream notice)
    
      61  install -m644 "$srcdir/LICENSE.plutonium" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2