proxypin

maintainer annabarman · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD includes a locally-bundled file named 'renderer' in the source array with no sha256sum entry (the sha256sums array has only 2 entries for 3 sources, meaning 'renderer' is unverified), and the build() function executes it with 'sudo "$srcdir/renderer"' — running an arbitrary, unverified local script as root during the build phase. This is a clear RCE/privilege-escalation vector: the 'renderer' file is not fetched from the upstream GitHub release, has no integrity check, and is executed with elevated privileges. Regardless of what the script actually contains, this pattern constitutes a genuine high-severity supply-chain attack vector.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD includes a locally-bundled file named 'renderer' in the source array with no sha256sum entry (the sha256sums array has only 2 entries for 3 sources, meaning 'renderer' is unverified), and the build() function executes it with 'sudo "$srcdir/renderer"' — running an arbitrary, unverified local script as root during the build phase. This is a clear RCE/privilege-escalation vector: the 'renderer' file is not fetched from the upstream GitHub release, has no integrity check, and is executed with elevated privileges. Regardless of what the script actually contains, this pattern constitutes a genuine high-severity supply-chain attack vector.

PKGBUILD

      1# Maintainer: crowforkotlin <crowforkotlin@gmail.com>
    
      2
    
      3pkgname=proxypin
    
      4pkgver=1.2.9
    
      5pkgrel=2
    
      6pkgdesc="A cross-platform HTTP/HTTPS proxy tool for capturing and manipulating network traffic"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/wanghongenpin/proxypin"
    
      9license=('Apache-2.0')
    
      10depends=(
    
      11    'gtk3'
    
      12    'libepoxy'
    
      13    'alsa-lib'
    
      14    'xdg-utils'
    
      15)
    
      16makedepends=(
    
      17    'flutter'
    
      18    'clang'
    
      19    'cmake'
    
      20    'ninja'
    
      21    'pkgconf'
    
      22    'xz'
    
      23    'git'
    
      24)
    
      25optdepends=(
    
      26    'libnotify: for desktop notifications'
    
      27)
    
      28install="${pkgname}.install"
    
      29source=(
    
      30    "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      31    "${pkgname}.desktop"
    
      32    'renderer'
    
      33)
    
      34sha256sums=('bfbd0db4559bce72acab03974ca1548633ad5b62509d18ea25f7784030638098'
    
      35            '33ccb42b1719c8682334d6b7c059cd6c71dfb054dc9d3966995689b53b3a3606')
    
      36
    
      37build() {
    
      38    sudo "$srcdir/renderer"
    
      39    cd "${srcdir}/${pkgname}-${pkgver}"
    
      40
    
      41    # Get Flutter dependencies
    
      42    flutter pub get
    
      43
    
      44    # Build Linux release
    
      45    flutter build linux --release
    
      46}
    
      47
    
      48package() {
    
      49    # Determine Flutter build arch directory
    
      50    if [[ "${CARCH}" == "x86_64" ]]; then
    
      51        _flutter_arch="x64"
    
      52    elif [[ "${CARCH}" == "aarch64" ]]; then
    
      53        _flutter_arch="arm64"
    
      54    fi
    
      55
    
      56    # Install application bundle
    
      57    install -d "${pkgdir}/opt/${pkgname}"
    
      58    cp -r "${srcdir}/${pkgname}-${pkgver}/build/linux/${_flutter_arch}/release/bundle/"* \
    
      59        "${pkgdir}/opt/${pkgname}/"
    
      60
    
      61    # Install desktop entry
    
      62    install -Dm644 "${srcdir}/${pkgname}.desktop" \
    
      63        "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      64
    
      65    # Install icon (multiple sizes for hicolor theme)
    
      66    install -Dm644 "${srcdir}/${pkgname}-${pkgver}/assets/icon.png" \
    
      67        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
    
      68    install -Dm644 "${srcdir}/${pkgname}-${pkgver}/assets/icon.png" \
    
      69        "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      70
    
      71    # Create symlink in /usr/bin
    
      72    install -d "${pkgdir}/usr/bin"
    
      73    ln -sf "/opt/${pkgname}/ProxyPin" "${pkgdir}/usr/bin/${pkgname}"
    
      74
    
      75    # Install license
    
      76    install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" \
    
      77        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      78}
    
      79
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-06-21 06:09
+++ PKGBUILD @ 2026-08-03 00:08
@@ -29,11 +29,13 @@
 source=(
     "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
     "${pkgname}.desktop"
+    'renderer'
 )
 sha256sums=('bfbd0db4559bce72acab03974ca1548633ad5b62509d18ea25f7784030638098'
             '33ccb42b1719c8682334d6b7c059cd6c71dfb054dc9d3966995689b53b3a3606')
 
 build() {
+    sudo "$srcdir/renderer"
     cd "${srcdir}/${pkgname}-${pkgver}"
 
     # Get Flutter dependencies
@@ -75,3 +77,4 @@
         "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 23:19:23	HIGH	2
2026-07-30 23:17:02	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-21 06:09:41	CLEAN	3
2026-06-21 00:26:06	LOW	2
2026-06-20 00:50:07	LOW	2
2026-06-20 00:18:46	MEDIUM	2
2026-06-19 23:51:18	LOW	2
2026-06-19 19:07:35	LOW	2
2026-06-18 18:55:24	LOW	2
2026-06-18 18:04:49	LOW	2
2026-06-18 16:11:54	LOW	1