pyrefly-bin

MEDIUM

maintainer minhnbnt 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt VSIX binaries from open-vsx.org, a third-party extension registry, which is not the project's primary source; while the checksums are verified, the origin is not the official project repository, posing a potential supply-chain risk if the artifact were swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_aarch64=("https://open-vsx.org/api/meta/pyrefly/linux-arm64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-arm64.vsix")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads prebuilt VSIX binaries from open-vsx.org, a third-party extension registry, which is not the project's primary source; while the checksums are verified, the origin is not the official project repository, posing a potential supply-chain risk if the artifact were swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Nguyễn Quang Minh <minhnbnt at gmail dot com>
    
      2
    
      3pkgname=pyrefly-bin
    
      4pkgver=1.3.1 # datasource=github-tags depName=facebook/pyrefly
    
      5pkgrel=1
    
      6pkgdesc='A faster Python type checker written in Rust'
    
      7provides=('pyrefly')
    
      8conflicts=('pyrefly')
    
      9arch=('aarch64' 'armv7h' 'x86_64')
    
      10url='https://pyrefly.org/'
    
      11license=('MIT')
    
      12
    
      13source_aarch64=("https://open-vsx.org/api/meta/pyrefly/linux-arm64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-arm64.vsix")
    
      14source_armv7h=("https://open-vsx.org/api/meta/pyrefly/linux-armhf/${pkgver}/file/meta.pyrefly-${pkgver}@linux-armhf.vsix")
    
      15source_x86_64=("https://open-vsx.org/api/meta/pyrefly/linux-x64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-x64.vsix")
    
      16
    
      17sha256sums_aarch64=('127f94c6ffa980a2d7ed799008059636a4a805b70091c2132e2921298cbb795e')
    
      18sha256sums_armv7h=('9cf4105aa0eaa9c984b62b4e9dd4b532fcec1f2f65c00b0c4f9682b5c9816466')
    
      19sha256sums_x86_64=('b520252c9ec2a0923301775ea94e994e8ed48256690ad82f51e1a0470abe11a1')
    
      20
    
      21package() {
    
      22
    
      23	cd "${srcdir}/extension"
    
      24
    
      25	install -Dm755 "bin/pyrefly" "${pkgdir}/usr/bin/pyrefly"
    
      26	install -Dm644 "LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      27}
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-09-15 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 # Contributor: Nguyễn Quang Minh <minhnbnt at gmail dot com>
 
 pkgname=pyrefly-bin
-pkgver=1.3.0 # datasource=github-tags depName=facebook/pyrefly
+pkgver=1.3.1 # datasource=github-tags depName=facebook/pyrefly
 pkgrel=1
 pkgdesc='A faster Python type checker written in Rust'
 provides=('pyrefly')
@@ -14,9 +14,9 @@
 source_armv7h=("https://open-vsx.org/api/meta/pyrefly/linux-armhf/${pkgver}/file/meta.pyrefly-${pkgver}@linux-armhf.vsix")
 source_x86_64=("https://open-vsx.org/api/meta/pyrefly/linux-x64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-x64.vsix")
 
-sha256sums_aarch64=('d3d7dfc24c938a0ec77e5249f92aff9b35b880d008047da72b103e94256c94c2')
-sha256sums_armv7h=('5a9a412935aead311a04eaba47b8379ba58e2c1f410308b26b9bccf31c283fec')
-sha256sums_x86_64=('68384ec81080edead80feb49e5c9c77c418a2f8675b690acda785b0da1f60e6a')
+sha256sums_aarch64=('127f94c6ffa980a2d7ed799008059636a4a805b70091c2132e2921298cbb795e')
+sha256sums_armv7h=('9cf4105aa0eaa9c984b62b4e9dd4b532fcec1f2f65c00b0c4f9682b5c9816466')
+sha256sums_x86_64=('b520252c9ec2a0923301775ea94e994e8ed48256690ad82f51e1a0470abe11a1')
 
 package() {
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 19:20:17	Medium	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 09:11:25	Medium	1
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2