python-fredapi

maintainer shimi · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package builds from a source tarball hosted on the official Python package index (pythonhosted.org), which is a trusted and appropriate source for PyPI packages; the recent orphaning and re-adoption of the package does not imply malicious intent or supply-chain risk in this case.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a source tarball hosted on the official Python package index (pythonhosted.org), which is a trusted and appropriate source for PyPI packages; the recent orphaning and re-adoption of the package does not imply malicious intent or supply-chain risk in this case.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Achmad Fathoni<fathoni.id(at)gmail.com>
    
      2pkgname=python-fredapi
    
      3_pkgname=${pkgname:7}
    
      4pkgver=0.5.1
    
      5pkgrel=1
    
      6pkgdesc="Python API for Federal Reserve Economic Data (FRED) from St. Louis Fed"
    
      7arch=('any')
    
      8url="https://pypi.org/project/${_pkgname}"
    
      9license=('Apache')
    
      10makedepends=(python-build python-installer python-wheel)
    
      11depends=(python python-pandas)
    
      12source=(https://files.pythonhosted.org/packages/source/${_pkgname::1}/$_pkgname/$_pkgname-$pkgver.tar.gz)
    
      13sha256sums=('fe6e2320641ea6b516de8f2dbef8affd2a55f30efb189846a5c19078738ef162')
    
      14
    
      15build() {
    
      16    cd ${srcdir}/${_pkgname}-${pkgver}
    
      17    python -m build --wheel --no-isolation
    
      18}
    
      19
    
      20package() {
    
      21    cd ${srcdir}/${_pkgname}-${pkgver}
    
      22    python -m installer --destdir="$pkgdir" dist/*.whl
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 13:30:33	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0