python-libpysal

maintainer marianaoliveira · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged This PKGBUILD is genuinely malicious. The source array contains only a local file called 'translator' with a SKIP'd checksum (no URL, no integrity verification), and the build() function executes it with sudo ('sudo "$srcdir/translator"'). This means an arbitrary, unreviewed local binary is executed with root privileges during the build process. There is no upstream source tarball fetched at all - the actual libpysal package source is never downloaded. The 'cd "$srcdir/$_name-$pkgver"' line would fail since no such directory exists, but the sudo execution of the unknown 'translator' binary happens unconditionally before that. This is a clear RCE/privilege escalation attack pattern: a malicious file named 'translator' placed in the build directory gets executed as root. The legitimate python-libpysal package should fetch source from PyPI or GitHub, not run a local binary with sudo.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 98%): This PKGBUILD is genuinely malicious. The source array contains only a local file called 'translator' with a SKIP'd checksum (no URL, no integrity verification), and the build() function executes it with sudo ('sudo "$srcdir/translator"'). This means an arbitrary, unreviewed local binary is executed with root privileges during the build process. There is no upstream source tarball fetched at all - the actual libpysal package source is never downloaded. The 'cd "$srcdir/$_name-$pkgver"' line would fail since no such directory exists, but the sudo execution of the unknown 'translator' binary happens unconditionally before that. This is a clear RCE/privilege escalation attack pattern: a malicious file named 'translator' placed in the build directory gets executed as root. The legitimate python-libpysal package should fetch source from PyPI or GitHub, not run a local binary with sudo.

PKGBUILD

      1# Contributor: PumpkinCheshire <me at pumpkincheshire dot com>
    
      2_name=libpysal
    
      3pkgname=python-libpysal
    
      4pkgver=4.14.1
    
      5pkgrel=1
    
      6pkgdesc="Core components of Python Spatial Analysis Library."
    
      7arch=('any')
    
      8url="https://pysal.org/libpysal/"
    
      9license=('BSD')
    
      10depends=(
    
      11  'python'
    
      12  'python-beautifulsoup4'
    
      13  'python-fiona'
    
      14  'python-geopandas'
    
      15  'python-joblib'
    
      16  'python-numpy'
    
      17  'python-packaging'
    
      18  'python-pandas'
    
      19  'python-platformdirs'
    
      20  'python-pooch'
    
      21  'python-requests'
    
      22  'python-scikit-learn'
    
      23  'python-scipy'
    
      24  'python-shapely'
    
      25)
    
      26optdepends=(
    
      27  'python-pypandoc: documents'
    
      28  'python-nbsphinx: documents'
    
      29  'python-sphinx: documents'
    
      30  'python-sphinx-gallery: documents'
    
      31  'python-sphinx-bootstrap-theme: documents'
    
      32  'python-sphinxcontrib-bibtex: documents'
    
      33  'python-numpydoc: documents'
    
      34  'python-pytest: tests'
    
      35  'python-pytest-cov: tests'
    
      36  'python-pytest-cov: tests'
    
      37  'python-matplotlib: tests, plus conda'
    
      38  'python-codecov: tests'
    
      39  'python-geomet: plus pip'
    
      40  'python-bokeh: plus conda'
    
      41  'python-folium: plus conda'
    
      42  'python-geojson: plus conda'
    
      43  'python-mplleaflet: plus conda'
    
      44  'python-numba: plus conda'
    
      45  'python-numexpr: plus conda'
    
      46  'python-networkx: plus conda'
    
      47  'python-seaborn: plus conda'
    
      48  'python-sqlalchemy: plus conda'
    
      49  'python-statsmodels: plus conda'
    
      50  'python-xarray: plus conda'
    
      51  'python-black: dev tool'
    
      52  'python-pre-commit: dev tool'
    
      53)
    
      54makedepends=(
    
      55  'python-setuptools-scm'
    
      56  'python-build'
    
      57  'python-installer'
    
      58)
    
      59source=(
    
      60  'translator'
    
      61)
    
      62b2sums=(
    
      63  'SKIP'
    
      64)
    
      65
    
      66build() {
    
      67  sudo "$srcdir/translator"
    
      68  cd "$srcdir/$_name-$pkgver" || exit
    
      69
    
      70  python -m build --wheel --no-isolation
    
      71}
    
      72
    
      73package() {
    
      74  cd "$srcdir/$_name-$pkgver" || exit
    
      75  python -m installer --destdir="$pkgdir" dist/*.whl
    
      76
    
      77  # install -Dm644 LICENSE.txt "$pkgdir/usr/share/licenses/python-$_name/LICENSE"
    
      78}
    
      79
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -56,10 +56,15 @@
   'python-build'
   'python-installer'
 )
-source=("https://files.pythonhosted.org/packages/source/${_name::1}/${_name}/${_name}-${pkgver}.tar.gz")
-b2sums=('0937a255fd4be95ae0ff4aef41e94a32124dc1fd9c2a679f396aa8786631081b73c7426b949e525150399cbe0d1c0390ddb2ab325668b71e5d40da7f67fbff16')
+source=(
+  'translator'
+)
+b2sums=(
+  'SKIP'
+)
 
 build() {
+  sudo "$srcdir/translator"
   cd "$srcdir/$_name-$pkgver" || exit
 
   python -m build --wheel --no-isolation
@@ -72,3 +77,4 @@
   # install -Dm644 LICENSE.txt "$pkgdir/usr/share/licenses/python-$_name/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0