progynosh

maintainer Franca · 0 votes · scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged The package downloads an executable script from a non-whitelisted, user-controlled GitHub repository with a skipped checksum, posing a supply-chain risk if the source were replaced with malicious code.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads an executable script from a non-whitelisted, user-controlled GitHub repository with a skipped checksum, posing a supply-chain risk if the source were replaced with malicious code.

PKGBUILD

1# Maintainer: TeaHouseLab(aka. Tsingkwai) <tsingkwai at ruzh dot top>
2pkgname="progynosh"
3pkgver="7"
4pkgrel="7"
5pkgdesc="A dev manager for dev fish shell script eaiser"
6arch=("x86_64")
7url="https://ruzhtw.top/pages/projects/progynosh"
8depends=("fish" "sudo")
9license=("GPL-3.0 License")
10provides=("progynosh")
11source=("https://raw.githubusercontent.com/happyeggchen/Progynosh/main/progynosh")
12sha256sums=("SKIP")
13package() {
14 mkdir -p "${pkgdir}/usr/bin"
15 cp "${srcdir}/progynosh" "${pkgdir}/usr/bin/progynosh"
16 chmod +x "${pkgdir}/usr/bin/progynosh"
17 rm ../progynosh
18 }
19
20

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 MEDIUM 2
2026-08-02 00:16:08 MEDIUM 2
2026-08-01 00:11:18 MEDIUM 2
2026-07-31 00:14:10 MEDIUM 2
2026-07-30 00:17:23 MEDIUM 2
2026-07-29 00:25:53 MEDIUM 2
2026-07-28 00:07:28 MEDIUM 2
2026-07-27 00:24:32 MEDIUM 2
2026-07-26 00:07:32 MEDIUM 2
2026-07-25 00:13:44 MEDIUM 2
2026-07-24 00:02:28 MEDIUM 2
2026-07-23 00:14:47 MEDIUM 2
2026-07-22 00:29:32 MEDIUM 2
2026-07-21 00:24:15 MEDIUM 2
2026-07-20 00:19:49 MEDIUM 2
2026-07-19 00:17:08 MEDIUM 2
2026-07-18 00:14:48 MEDIUM 2
2026-07-17 00:06:16 MEDIUM 2
2026-07-16 00:05:41 MEDIUM 2
2026-07-15 00:09:25 MEDIUM 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion