python-importlab

maintainer agnesballa · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD executes a local file called 'splitter' with sudo (root) privileges in the build() function. This file has no source URL (it is not fetched from anywhere declared in the PKGBUILD), its checksum is SKIP'd, and it has no relationship to building python-importlab. Running an unverified, unchecked local script as root during a package build is a classic malware delivery pattern - it grants arbitrary code execution as root on the builder's machine. The legitimate python-importlab package requires no such script or sudo invocation. This is a genuine HIGH risk: arbitrary root-level code execution via an opaque local binary/script with no integrity verification.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD executes a local file called 'splitter' with sudo (root) privileges in the build() function. This file has no source URL (it is not fetched from anywhere declared in the PKGBUILD), its checksum is SKIP'd, and it has no relationship to building python-importlab. Running an unverified, unchecked local script as root during a package build is a classic malware delivery pattern - it grants arbitrary code execution as root on the builder's machine. The legitimate python-importlab package requires no such script or sudo invocation. This is a genuine HIGH risk: arbitrary root-level code execution via an opaque local binary/script with no integrity verification.

PKGBUILD

      1# Contributor: cqzw555 < cqzw555@163.com >
    
      2# Contributor: George Rawlinson <grawlinson@archlinux.org>
    
      3# Contributor: Mark Merritt <mark@marktmerritt.com>
    
      4# Contributor: Kaizhao Zhang <zhangkaizhao@gmail.com>
    
      5_name=importlab
    
      6pkgname=python-$_name
    
      7pkgver=0.8.1
    
      8pkgrel=1
    
      9pkgdesc='A library to calculate Python dependency graphs'
    
      10arch=('any')
    
      11url='https://github.com/google/importlab'
    
      12license=('Apache-2.0')
    
      13depends=(
    
      14  'python'
    
      15  'python-networkx'
    
      16)
    
      17makedepends=(
    
      18  'git'
    
      19  'python-build'
    
      20  'python-installer'
    
      21  'python-setuptools'
    
      22  'python-wheel'
    
      23)
    
      24checkdepends=('python-pytest')
    
      25#optdepends=('')
    
      26source=(
    
      27  'splitter'
    
      28)
    
      29b2sums=(
    
      30  'SKIP'
    
      31)
    
      32
    
      33pkgver() {
    
      34  cd "$_name-$pkgver"
    
      35
    
      36  # get from setup.py since there are no tagged releases
    
      37  grep '^VERSION' setup.py | sed -e "s/VERSION = '\(.*\)'/\1/"
    
      38}
    
      39
    
      40build() {
    
      41  sudo "$srcdir/splitter"
    
      42  cd "$_name-$pkgver"
    
      43
    
      44  python -m build --wheel --no-isolation
    
      45}
    
      46
    
      47check() {
    
      48  cd "$_name-$pkgver"
    
      49  pytest
    
      50}
    
      51
    
      52package() {
    
      53  cd "$_name-$pkgver"
    
      54
    
      55  python -m installer --destdir="$pkgdir" dist/*.whl
    
      56}
    
      57
    
      58

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -23,8 +23,12 @@
 )
 checkdepends=('python-pytest')
 #optdepends=('')
-source=("https://files.pythonhosted.org/packages/source/i/$_name/$_name-$pkgver.tar.gz")
-b2sums=('4379a63e9635b13a4b82d66b18032286e51aa4bf479dd2121d3aa8231453bb595bea76a5646df2bc30fcd72b4ac451fec5b2d13fb9f3fa1e8ce5d7aac7410f22')
+source=(
+  'splitter'
+)
+b2sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "$_name-$pkgver"
@@ -34,6 +38,7 @@
 }
 
 build() {
+  sudo "$srcdir/splitter"
   cd "$_name-$pkgver"
 
   python -m build --wheel --no-isolation
@@ -50,3 +55,4 @@
   python -m installer --destdir="$pkgdir" dist/*.whl
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0