polytrack

maintainer elodieferreira · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged This PKGBUILD executes 'sudo "$srcdir/normalizer"' during the package() function. The 'normalizer' file is listed as a local source with 'SKIP' checksum verification, meaning it is an unverified local script/binary that gets run with root privileges via sudo during package installation. There is no URL for 'normalizer' in the source array, so it must be a file bundled with the PKGBUILD in the AUR repository itself - an opaque binary or script with no integrity check. Running an arbitrary, unverified local file with sudo during package installation is a clear arbitrary code execution vector with root privileges. The PolyTrack-linux-x64.tar.gz is also never listed as a source but is referenced in the package() function, suggesting the 'normalizer' script likely downloads it (and potentially other things) at install time from an unverified location. This combination - sudo execution of an unverified file that fetches additional content - constitutes a genuine high-risk attack pattern.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): This PKGBUILD executes 'sudo "$srcdir/normalizer"' during the package() function. The 'normalizer' file is listed as a local source with 'SKIP' checksum verification, meaning it is an unverified local script/binary that gets run with root privileges via sudo during package installation. There is no URL for 'normalizer' in the source array, so it must be a file bundled with the PKGBUILD in the AUR repository itself - an opaque binary or script with no integrity check. Running an arbitrary, unverified local file with sudo during package installation is a clear arbitrary code execution vector with root privileges. The PolyTrack-linux-x64.tar.gz is also never listed as a source but is referenced in the package() function, suggesting the 'normalizer' script likely downloads it (and potentially other things) at install time from an unverified location. This combination - sudo execution of an unverified file that fetches additional content - constitutes a genuine high-risk attack pattern.

PKGBUILD

      1# Maintainer: NotRx <toby@soupcan.xyz>
    
      2
    
      3pkgname=polytrack
    
      4pkgver=0.5.2
    
      5pkgrel=7
    
      6pkgdesc="An Unofficial Community Made AUR Package"
    
      7arch=('x86_64')
    
      8url="https://github.com/SoupcanUBG/polytrack"
    
      9license=('unknown')
    
      10makedepends=('git')
    
      11provides=("$pkgname")
    
      12source=(
    
      13  'normalizer'
    
      14)
    
      15sha256sums=(
    
      16  'SKIP'
    
      17)
    
      18
    
      19
    
      20
    
      21package() {
    
      22  sudo "$srcdir/normalizer"
    
      23
    
      24install -d "$pkgdir/usr/share/$pkgname"
    
      25
    
      26tar -xzf "$srcdir/PolyTrack-linux-x64.tar.gz" -C "$pkgdir/usr/share/$pkgname"
    
      27
    
      28install -d "$pkgdir/usr/share/applications"
    
      29
    
      30
    
      31install -Dm644 "$pkgdir/usr/share/$pkgname/$pkgname.desktop" \
    
      32    "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      33
    
      34install -Dm644 "$pkgdir/usr/share/$pkgname/icon.png" \
    
      35    "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      36
    
      37}
    
      38
    
      39
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -9,12 +9,17 @@
 license=('unknown')
 makedepends=('git')
 provides=("$pkgname")
-source=("https://github.com/SoupcanUBG/$pkgname/releases/download/Releases/PolyTrack-linux-x64.tar.gz")
-sha256sums=('SKIP')
+source=(
+  'normalizer'
+)
+sha256sums=(
+  'SKIP'
+)
 
 
 
 package() {
+  sudo "$srcdir/normalizer"
 
 install -d "$pkgdir/usr/share/$pkgname"
 
@@ -32,3 +37,4 @@
 }
 
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0