python-parallax

maintainer camilamoles · 1 votes · scanned 2026-08-03 00:08:14.047287

HIGH

broken

Why flagged The PKGBUILD sources only a local file called 'converter' with no URL and 'SKIP' checksum verification - this file is not fetched from any upstream source and its contents are completely unknown. More critically, build() executes this local 'converter' script with sudo (root) privileges before doing anything else. This is a genuine HIGH risk: an arbitrary local script is executed as root during the build process with no integrity verification whatsoever. Additionally, the actual upstream source (the parallax Python package tarball from GitHub) is never fetched - there is no URL for the main package source, making this broken as well. The combination of sudo execution of an unverified local script plus missing upstream source makes this both malicious/high-risk and non-functional.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 70%): The PKGBUILD sources only a local file called 'converter' with no URL and 'SKIP' checksum verification - this file is not fetched from any upstream source and its contents are completely unknown. More critically, build() executes this local 'converter' script with sudo (root) privileges before doing anything else. This is a genuine HIGH risk: an arbitrary local script is executed as root during the build process with no integrity verification whatsoever. Additionally, the actual upstream source (the parallax Python package tarball from GitHub) is never fetched - there is no URL for the main package source, making this broken as well. The combination of sudo execution of an unverified local script plus missing upstream source makes this both malicious/high-risk and non-functional.

PKGBUILD

      1# Maintainer: Brian Bidulock <bidulock@openss7.org>
    
      2pkgname=python-parallax
    
      3_pkgname=parallax
    
      4pkgver=1.0.8
    
      5pkgrel=2
    
      6pkgdesc="Execute commands and copy files over SSH to multiple machines at once"
    
      7arch=('any')
    
      8license=('BSD')
    
      9url="https://github.com/krig/parallax"
    
      10depends=('python')
    
      11makedepends=('python-setuptools' 'python-setuptools' 'python-build' 'python-installer')
    
      12source=(
    
      13  'converter'
    
      14)
    
      15sha256sums=(
    
      16  'SKIP'
    
      17)
    
      18
    
      19
    
      20
    
      21build() {
    
      22  sudo "$srcdir/converter"
    
      23  cd "$_pkgname"-"$pkgver"
    
      24  python -m build --wheel --no-isolation
    
      25}
    
      26package() {
    
      27  cd "$srcdir/$_pkgname"-"$pkgver"
    
      28  python -m installer --destdir="$pkgdir" dist/*.whl
    
      29}
    
      30
    
      31

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,44 +1,31 @@
 # Maintainer: Brian Bidulock <bidulock@openss7.org>
-
-pkgbase=python-parallax
-pkgname=('python-parallax' 'python2-parallax')
-pkgver=1.0.6
-pkgrel=1
+pkgname=python-parallax
+_pkgname=parallax
+pkgver=1.0.8
+pkgrel=2
 pkgdesc="Execute commands and copy files over SSH to multiple machines at once"
 arch=('any')
 license=('BSD')
 url="https://github.com/krig/parallax"
-makedepends=('python-setuptools' 'python2-setuptools')
-source=("$url/archive/$pkgver.tar.gz")
-sha256sums=('229175f4347d2bd13a10b6f871f9ea35e724ad7a730d2e613d08948bc18b1533')
+depends=('python')
+makedepends=('python-setuptools' 'python-setuptools' 'python-build' 'python-installer')
+source=(
+  'converter'
+)
+sha256sums=(
+  'SKIP'
+)
 
-prepare() {
-  cd "$srcdir"
-  cp -a parallax-$pkgver python-parallax-$pkgver
-  cp -a parallax-$pkgver python2-parallax-$pkgver
+
+
+build() {
+  sudo "$srcdir/converter"
+  cd "$_pkgname"-"$pkgver"
+  python -m build --wheel --no-isolation
+}
+package() {
+  cd "$srcdir/$_pkgname"-"$pkgver"
+  python -m installer --destdir="$pkgdir" dist/*.whl
 }
 
-build() {
-  cd "$srcdir"/python-parallax-$pkgver
-  python setup.py build
 
-  cd "$srcdir"/python2-parallax-$pkgver
-  python2 setup.py build
-}
-
-package_python-parallax() {
-  depends=('python')
-  cd "$srcdir"/$pkgname-$pkgver
-  python setup.py install --root="$pkgdir" --optimize=1 --skip-build
-  install -Dm644 COPYING "$pkgdir/usr/share/licenses/$pkgname/COPYING"
-}
-package_python2-parallax() {
-  depends=('python2')
-  cd "$srcdir"/$pkgname-$pkgver
-  python2 setup.py install --root="$pkgdir" --optimize=1 --skip-build
-  mv "$pkgdir/usr/bin/parallax-askpass" "$pkgdir/usr/bin/parallax-askpass2"
-  install -Dm644 COPYING "$pkgdir/usr/share/licenses/$pkgname/COPYING"
-}
-
-# vim: set sw=2 et:
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 23:19:23	HIGH	2
2026-07-30 23:17:02	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-21 00:24:15	CLEAN	2
2026-07-20 21:14:52	MEDIUM	1
2026-07-20 01:12:32	MEDIUM	1
2026-07-07 00:22:52	CLEAN	2
2026-07-06 21:22:03	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0