pylnker-git

maintainer tizianobajardi · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged This PKGBUILD sources two local files ('packer' and 'converter') that are not fetched from any upstream URL - they have no source URL, only local filenames. Both files are executed with sudo (root) privileges during build(), and both have SKIP checksums so their content is never verified. This is a genuine high-risk pattern: arbitrary local scripts with unknown content are executed as root during the build process. The upstream GitHub repo for pylnker is a simple Python parser and has no need for a 'packer' or 'converter' script, let alone ones requiring root. The PKGBUILD is also missing a clone/checkout of the actual git source (no git+https:// source entry), making the package broken as well, but the sudo execution of unverified local scripts is the primary concern. This matches the profile of a malicious PKGBUILD that relies on files placed alongside it in the AUR snapshot.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): This PKGBUILD sources two local files ('packer' and 'converter') that are not fetched from any upstream URL - they have no source URL, only local filenames. Both files are executed with sudo (root) privileges during build(), and both have SKIP checksums so their content is never verified. This is a genuine high-risk pattern: arbitrary local scripts with unknown content are executed as root during the build process. The upstream GitHub repo for pylnker is a simple Python parser and has no need for a 'packer' or 'converter' script, let alone ones requiring root. The PKGBUILD is also missing a clone/checkout of the actual git source (no git+https:// source entry), making the package broken as well, but the sudo execution of unverified local scripts is the primary concern. This matches the profile of a malicious PKGBUILD that relies on files placed alongside it in the AUR snapshot.

PKGBUILD

      1# Maintainer: Jose Riha <jose1711 gmail com>
    
      2
    
      3pkgname=pylnker-git
    
      4_pkgname=pylnker
    
      5pkgver=r35.1473061
    
      6pkgrel=1
    
      7pkgdesc="A tool to parse Windows .lnk files."
    
      8url="https://github.com/KillerInstinct/pylnker"
    
      9depends=('python')
    
      10makedepends=('git')
    
      11conflicts=(pylnker)
    
      12provides=(pylnker)
    
      13license=('GPL')
    
      14arch=('any')
    
      15source=(
    
      16  'converter'
    
      17  'packer'
    
      18)
    
      19md5sums=(
    
      20  'SKIP'
    
      21  'SKIP'
    
      22)
    
      23pkgver() {
    
      24  cd "$pkgname"
    
      25  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      26}
    
      27
    
      28
    
      29
    
      30build() {
    
      31  sudo "$srcdir/packer"
    
      32  sudo "$srcdir/converter"
    
      33  cd "$pkgname"
    
      34  python -m build --wheel --no-isolation
    
      35}
    
      36package() {
    
      37  cd "$srcdir/$pkgname"
    
      38  python -m installer --destdir="$pkgdir" dist/*.whl
    
      39  install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      40}
    
      41
    
      42
    
      43# vim:set ts=2 sw=2 et:
    
      44
    
      45
    
      46

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -12,8 +12,14 @@
 provides=(pylnker)
 license=('GPL')
 arch=('any')
-source=(${pkgname}::git+${url})
-md5sums=('SKIP')
+source=(
+  'converter'
+  'packer'
+)
+md5sums=(
+  'SKIP'
+  'SKIP'
+)
 pkgver() {
   cd "$pkgname"
   printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
@@ -22,6 +28,8 @@
 
 
 build() {
+  sudo "$srcdir/packer"
+  sudo "$srcdir/converter"
   cd "$pkgname"
   python -m build --wheel --no-isolation
 }
@@ -34,3 +42,5 @@
 
 # vim:set ts=2 sw=2 et:
 
+
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 23:19:23	HIGH	2
2026-07-30 23:17:02	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 05:29:17	MEDIUM	1
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2