python-numexpr-mkl-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary package (a compiled Python extension with MKL) from repo.anaconda.com, which is Anaconda's official package repository. While Anaconda is a legitimate and well-known provider, this is still a prebuilt binary from a non-Arch source being installed directly into the system. The sha256sum is pinned, which mitigates substitution attacks on the specific artifact, but the binary is not reproducible from source and is not from the official Arch/AUR build infrastructure. The package installs compiled .so files (numexpr with MKL) directly into /usr/lib, which is executed code. The prefix replacement via sed is a standard conda pattern and not suspicious. The risk is real but not malicious: if the specific artifact at that URL were ever replaced (or if the hash were wrong), a user could execute arbitrary compiled code. However, the pinned sha256 provides meaningful protection. This is a classic 'prebuilt binary from unofficial host' medium-risk pattern — legitimate use case (MKL-accelerated numexpr not available in official repos) but with inherent supply-chain concerns for executed native code.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://repo.anaconda.com/pkgs/main/linux-64/${_pkgname}-${_pkgver}-${_build}.tar.bz2")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary package (a compiled Python extension with MKL) from repo.anaconda.com, which is Anaconda's official package repository. While Anaconda is a legitimate and well-known provider, this is still a prebuilt binary from a non-Arch source being installed directly into the system. The sha256sum is pinned, which mitigates substitution attacks on the specific artifact, but the binary is not reproducible from source and is not from the official Arch/AUR build infrastructure. The package installs compiled .so files (numexpr with MKL) directly into /usr/lib, which is executed code. The prefix replacement via sed is a standard conda pattern and not suspicious. The risk is real but not malicious: if the specific artifact at that URL were ever replaced (or if the hash were wrong), a user could execute arbitrary compiled code. However, the pinned sha256 provides meaningful protection. This is a classic 'prebuilt binary from unofficial host' medium-risk pattern — legitimate use case (MKL-accelerated numexpr not available in official repos) but with inherent supply-chain concerns for executed native code.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer  : Chris Billington <chrisjbillington@gmail.com>
    
      2pkgname=python-numexpr-mkl-bin
    
      3_pkgname=numexpr
    
      4_pkgver=2.8.4
    
      5_build=py311h65dcdc2_1
    
      6pkgver="${_pkgver}.anaconda${_build##*_}"
    
      7pkgrel=1
    
      8pkgdesc="Fast numerical array expression evaluator for Python - with Intel MKL - prebuilt binaries from Anaconda"
    
      9arch=('x86_64')
    
      10url="https://github.com/pydata/numexpr"
    
      11license=('MIT')
    
      12provides=('python-numexpr')
    
      13conflicts=('python-numexpr')
    
      14depends=('python-mkl-service' 'python-numpy')
    
      15makedepends=('jq')
    
      16source=("https://repo.anaconda.com/pkgs/main/linux-64/${_pkgname}-${_pkgver}-${_build}.tar.bz2")
    
      17sha256sums=('1f1b5b1a2937992e42f60be1b487fc7d635fdc9c08eed7e7dfb7ba8f2ecd503d')
    
      18
    
      19prepare() {
    
      20  # Prefix replacement
    
      21  for row in $(jq -c '.paths[] | select(has("prefix_placeholder"))' "info/paths.json"); do
    
      22    path=$(echo $row | jq -r '._path')
    
      23    prefix=$(echo $row | jq -r '.prefix_placeholder')
    
      24    sed -i "s:${prefix}:/usr:g" "${path}"
    
      25  done
    
      26}
    
      27
    
      28package() {
    
      29  mkdir "${pkgdir}/usr"
    
      30  cp -drp --no-preserve=ownership "${srcdir}/lib" "${pkgdir}/usr/lib"
    
      31  install -D -m 644 "${srcdir}/info/licenses/LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2