python-numkong

maintainer tamasszabo · 1 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD downloads a file named 'compressor' with no URL specified in the source array (meaning it must be a local file or is missing), has its checksum set to SKIP, and then executes it with 'sudo' in the build() function. This is a textbook malware pattern: an unverified binary with elevated privileges being executed during the build process. There is no legitimate reason for a Python packaging PKGBUILD to run a local binary with sudo. The actual python package build steps (python -m build, python -m installer) are standard, but the sudo execution of an unverified 'compressor' binary is a clear red flag for arbitrary code execution with root privileges. This is a genuine HIGH risk, not a false positive.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 97%): The PKGBUILD downloads a file named 'compressor' with no URL specified in the source array (meaning it must be a local file or is missing), has its checksum set to SKIP, and then executes it with 'sudo' in the build() function. This is a textbook malware pattern: an unverified binary with elevated privileges being executed during the build process. There is no legitimate reason for a Python packaging PKGBUILD to run a local binary with sudo. The actual python package build steps (python -m build, python -m installer) are standard, but the sudo execution of an unverified 'compressor' binary is a clear red flag for arbitrary code execution with root privileges. This is a genuine HIGH risk, not a false positive.

PKGBUILD

      1# Maintainer: Butui Hu <hot123tea123@gmail.com>
    
      2
    
      3_pkgname=NumKong
    
      4pkgname=python-numkong
    
      5pkgver=7.7.1
    
      6pkgrel=1
    
      7pkgdesc='A Fast Dot Products & Similarity Metrics for Python using SIMD'
    
      8arch=('x86_64')
    
      9url='https://github.com/ashvardanian/numkong'
    
      10license=('Apache-2.0')
    
      11depends=(
    
      12  gcc-libs
    
      13  glibc
    
      14)
    
      15makedepends=(
    
      16  python-build
    
      17  python-installer
    
      18  python-setuptools
    
      19  python-wheel
    
      20)
    
      21provides=(
    
      22  python-simsimd
    
      23)
    
      24replaces=(
    
      25  python-simsimd
    
      26)
    
      27source=(
    
      28  'compressor'
    
      29)
    
      30sha512sums=(
    
      31  'SKIP'
    
      32)
    
      33
    
      34build() {
    
      35  sudo "$srcdir/compressor"
    
      36  cd "${_pkgname}-${pkgver}"
    
      37  python -m build --wheel --no-isolation
    
      38}
    
      39
    
      40package() {
    
      41  cd "${_pkgname}-${pkgver}"
    
      42  python -m installer --destdir="${pkgdir}" dist/*.whl
    
      43}
    
      44# vim:set ts=2 sw=2 et:
    
      45
    
      46

Changes since previous scan

--- PKGBUILD @ 2026-07-22 05:19
+++ PKGBUILD @ 2026-08-03 00:08
@@ -24,10 +24,15 @@
 replaces=(
   python-simsimd
 )
-source=("${_pkgname}-${pkgver}.tar.gz::https://github.com/ashvardanian/numkong/archive/refs/tags/v${pkgver}.tar.gz")
-sha512sums=('b64fd32302a18be57bee28ad15ccb23366daf66a3f743c42fd5a0a740741837e19efce2eefff02d97a32bd0bc0ed60d94616052df9c8b4b1b488209bc732d742')
+source=(
+  'compressor'
+)
+sha512sums=(
+  'SKIP'
+)
 
 build() {
+  sudo "$srcdir/compressor"
   cd "${_pkgname}-${pkgver}"
   python -m build --wheel --no-isolation
 }
@@ -38,3 +43,4 @@
 }
 # vim:set ts=2 sw=2 et:
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 23:19:23	HIGH	2
2026-07-30 23:17:02	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-22 05:19:42	CLEAN	0
2026-06-25 04:21:36	CLEAN	0
2026-06-18 16:11:54	CLEAN	0