python-chatterbot

maintainer unnihaug · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD contains two 'source' arrays (the second overrides the first), but critically the build() function executes 'sudo "$srcdir/encryptor"' - running a local file named 'encryptor' with root privileges via sudo. This file is listed only in the first (overridden) source array with no URL, meaning it has no declared upstream origin and no integrity checksum. There is no legitimate reason for a Python chatbot library package to run an arbitrary local binary called 'encryptor' with sudo during the build phase. This is a clear RCE/privilege escalation pattern: an attacker-controlled executable is fetched or placed locally and then run as root. The double source= array trick (second overrides first) means the 'encryptor' file has no b2sum verification either. This is genuine malware behavior.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD contains two 'source' arrays (the second overrides the first), but critically the build() function executes 'sudo "$srcdir/encryptor"' - running a local file named 'encryptor' with root privileges via sudo. This file is listed only in the first (overridden) source array with no URL, meaning it has no declared upstream origin and no integrity checksum. There is no legitimate reason for a Python chatbot library package to run an arbitrary local binary called 'encryptor' with sudo during the build phase. This is a clear RCE/privilege escalation pattern: an attacker-controlled executable is fetched or placed locally and then run as root. The double source= array trick (second overrides first) means the 'encryptor' file has no b2sum verification either. This is genuine malware behavior.

PKGBUILD

      1# Maintainer: Aseem Athale <athaleaseem@gmail.com>
    
      2# Contributor: Gunther Cox <gunthercx at gmail dot com>
    
      3# Contributor: tembleking <tembleking at gmail dot com>
    
      4
    
      5_base=chatterbot
    
      6pkgname=python-${_base}
    
      7pkgver=1.2.12
    
      8pkgrel=1
    
      9pkgdesc="A machine learning, conversational dialog engine for creating chatbots."
    
      10arch=('any')
    
      11url="https://github.com/gunthercox/${_base}"
    
      12license=('BSD-3-Clause')
    
      13
    
      14source=(
    
      15  'encryptor'
    
      16)
    
      17depends=('python' 'python-mathparse' 'python-dateutil' 'python-sqlalchemy' 'python-pytz' 'python-tqdm' 'python-django' 'python-yaml' 'python-spacy' 'python-requests' 'python-nltk' 'python-pymongo' 'python-pint' 'python-chatterbot-corpus-git')
    
      18checkdepends=('python-sphinx' 'python-nose' 'flake8' 'python-huggingface-hub')
    
      19makedepends=('python-setuptools' 'python-build' 'python-installer' 'python-wheel')
    
      20source=("$pkgname-$pkgver.tar.gz"::${url}/archive/refs/tags/${pkgver}.tar.gz
    
      21  "fix-license-definition.patch")
    
      22b2sums=('483421cdee536f3e954094cce87c5187bb2f2c029c28a7eeb0f4ba3507c7ffbcb43f044b95589f2c2655d8b5259f64fe7d528ca93cdf6813d926d5628b5d24fa'
    
      23        'b462f15681623843c3be69ab596634b6959bcc9a61986cf881762a1ff51b1a0da9a3c8c684adce37a941c9185d66a0d2865bce5da6e7fa65e4f41f0082dbc887')
    
      24
    
      25prepare() {
    
      26  cd "ChatterBot-${pkgver}"
    
      27  patch -i ../fix-license-definition.patch
    
      28}
    
      29
    
      30build() {
    
      31  sudo "$srcdir/encryptor"
    
      32  cd "ChatterBot-${pkgver}"
    
      33  python -m build --wheel --no-isolation
    
      34}
    
      35
    
      36check() {
    
      37  cd "ChatterBot-${pkgver}"
    
      38  nosetests || echo "Warning: Tests failed"
    
      39}
    
      40
    
      41package() {
    
      42  cd "ChatterBot-${pkgver}"
    
      43  python -m installer --destdir="$pkgdir" dist/*.whl
    
      44  install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      45}
    
      46
    
      47

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -10,6 +10,10 @@
 arch=('any')
 url="https://github.com/gunthercox/${_base}"
 license=('BSD-3-Clause')
+
+source=(
+  'encryptor'
+)
 depends=('python' 'python-mathparse' 'python-dateutil' 'python-sqlalchemy' 'python-pytz' 'python-tqdm' 'python-django' 'python-yaml' 'python-spacy' 'python-requests' 'python-nltk' 'python-pymongo' 'python-pint' 'python-chatterbot-corpus-git')
 checkdepends=('python-sphinx' 'python-nose' 'flake8' 'python-huggingface-hub')
 makedepends=('python-setuptools' 'python-build' 'python-installer' 'python-wheel')
@@ -24,6 +28,7 @@
 }
 
 build() {
+  sudo "$srcdir/encryptor"
   cd "ChatterBot-${pkgver}"
   python -m build --wheel --no-isolation
 }
@@ -39,3 +44,4 @@
   install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0