pyrefly-bin

MEDIUM

maintainer minhnbnt 2 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt .vsix binaries from open-vsx.org, a third-party extension marketplace, which constitutes an unverifiable executable supply chain risk despite being a known platform.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_aarch64=("https://open-vsx.org/api/meta/pyrefly/linux-arm64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-arm64.vsix")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .vsix binaries from open-vsx.org, a third-party extension marketplace, which constitutes an unverifiable executable supply chain risk despite being a known platform.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Nguyễn Quang Minh <minhnbnt at gmail dot com>
    
      2
    
      3pkgname=pyrefly-bin
    
      4pkgver=1.4.0 # datasource=github-tags depName=facebook/pyrefly
    
      5pkgrel=1
    
      6pkgdesc='A faster Python type checker written in Rust'
    
      7provides=('pyrefly')
    
      8conflicts=('pyrefly')
    
      9arch=('aarch64' 'armv7h' 'x86_64')
    
      10url='https://pyrefly.org/'
    
      11license=('MIT')
    
      12
    
      13source_aarch64=("https://open-vsx.org/api/meta/pyrefly/linux-arm64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-arm64.vsix")
    
      14source_armv7h=("https://open-vsx.org/api/meta/pyrefly/linux-armhf/${pkgver}/file/meta.pyrefly-${pkgver}@linux-armhf.vsix")
    
      15source_x86_64=("https://open-vsx.org/api/meta/pyrefly/linux-x64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-x64.vsix")
    
      16
    
      17sha256sums_aarch64=('eeb7860055be1010a2cc274df688a6794a9a80f2f5114c40cc31bc864e1b593a')
    
      18sha256sums_armv7h=('408572d2063d3b227a40db4a30646d7589e9a05d3001b1fd34d81a923701dfd4')
    
      19sha256sums_x86_64=('97dad84a8d988da68041aa572720a9e7fa9a848e63a70cb421a68298adf99275')
    
      20
    
      21package() {
    
      22
    
      23	cd "${srcdir}/extension"
    
      24
    
      25	install -Dm755 "bin/pyrefly" "${pkgdir}/usr/bin/pyrefly"
    
      26	install -Dm644 "LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      27}
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Contributor: Nguyễn Quang Minh <minhnbnt at gmail dot com>
 
 pkgname=pyrefly-bin
-pkgver=1.3.2 # datasource=github-tags depName=facebook/pyrefly
+pkgver=1.4.0 # datasource=github-tags depName=facebook/pyrefly
 pkgrel=1
 pkgdesc='A faster Python type checker written in Rust'
 provides=('pyrefly')
@@ -14,9 +14,9 @@
 source_armv7h=("https://open-vsx.org/api/meta/pyrefly/linux-armhf/${pkgver}/file/meta.pyrefly-${pkgver}@linux-armhf.vsix")
 source_x86_64=("https://open-vsx.org/api/meta/pyrefly/linux-x64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-x64.vsix")
 
-sha256sums_aarch64=('3642b0ef42f3e762424b0e1811cab8bd4311b8a9e9bb5997b9ac86eecbd48922')
-sha256sums_armv7h=('7c99e178d8c3054471d216d06866b017ac76a2ead52ddb3cba308b8e3ba4949b')
-sha256sums_x86_64=('541f66d8a8ebab2c6b52d8494155fa4ba5ffef62ea5e5c3fca7cac0075723417')
+sha256sums_aarch64=('eeb7860055be1010a2cc274df688a6794a9a80f2f5114c40cc31bc864e1b593a')
+sha256sums_armv7h=('408572d2063d3b227a40db4a30646d7589e9a05d3001b1fd34d81a923701dfd4')
+sha256sums_x86_64=('97dad84a8d988da68041aa572720a9e7fa9a848e63a70cb421a68298adf99275')
 
 package() {
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 01:13:57	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2