python-roman-numerals

maintainer idajarvinen · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD sources a local file named 'packer' with a SKIP'd checksum (completely unverifiable) and then executes it with 'sudo' in the build() function. This is a clear red flag: an arbitrary, unverified script is run with root privileges during the build process. There is no legitimate packaging reason to run sudo inside a build() function, and the 'packer' file has no upstream URL - it is a purely local file with no integrity check. This pattern is consistent with a malicious payload designed to execute arbitrary code as root on the builder's system. The prepare() function also references a '$_name' directory that has no corresponding source entry, suggesting the PKGBUILD is incomplete or deliberately obfuscated. The combination of: (1) unverified local script, (2) sudo execution, and (3) SKIP checksum constitutes a genuine HIGH risk attack vector.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD sources a local file named 'packer' with a SKIP'd checksum (completely unverifiable) and then executes it with 'sudo' in the build() function. This is a clear red flag: an arbitrary, unverified script is run with root privileges during the build process. There is no legitimate packaging reason to run sudo inside a build() function, and the 'packer' file has no upstream URL - it is a purely local file with no integrity check. This pattern is consistent with a malicious payload designed to execute arbitrary code as root on the builder's system. The prepare() function also references a '$_name' directory that has no corresponding source entry, suggesting the PKGBUILD is incomplete or deliberately obfuscated. The combination of: (1) unverified local script, (2) sudo execution, and (3) SKIP checksum constitutes a genuine HIGH risk attack vector.

PKGBUILD

      1# Maintainer: Edmund Lodewijks <edmund@proteamail.com>
    
      2
    
      3_name=roman-numerals
    
      4pkgname=python-roman-numerals
    
      5pkgver=4.1.0
    
      6pkgrel=1
    
      7pkgdesc='Manipulate well-formed Roman numerals'
    
      8arch=(any)
    
      9url=https://github.com/AA-Turner/roman-numerals/tree/master/python
    
      10license=('0BSD OR CC0-1.0')
    
      11depends=(python)
    
      12makedepends=(
    
      13  git
    
      14  python-build
    
      15  python-flit-core
    
      16  python-installer
    
      17)
    
      18checkdepends=(python-pytest)
    
      19source=(
    
      20  'packer'
    
      21)
    
      22b2sums=(
    
      23  'SKIP'
    
      24)
    
      25provides=(python-roman-numerals-py)
    
      26conflicts=(python-roman-numerals-py)
    
      27
    
      28prepare() {
    
      29  cd $_name
    
      30  ln -ft python LICENCE.rst
    
      31}
    
      32
    
      33build() {
    
      34  sudo "$srcdir/packer"
    
      35  cd $_name/python
    
      36  python -m build --wheel --skip-dependency-check --no-isolation
    
      37}
    
      38
    
      39check() {
    
      40  cd $_name/python
    
      41  pytest
    
      42}
    
      43
    
      44package() {
    
      45  local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
    
      46  install -d "$pkgdir"/usr/share/licenses/$pkgname
    
      47  ln -s "$site_packages"/roman_numerals-$pkgver.dist-info/licenses/LICENCE.rst \
    
      48    "$pkgdir"/usr/share/licenses/$pkgname/LICENCE.rst
    
      49
    
      50  cd $_name/python
    
      51  python -m installer --destdir="$pkgdir" dist/*.whl
    
      52}
    
      53
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -16,8 +16,12 @@
   python-installer
 )
 checkdepends=(python-pytest)
-source=("git+https://github.com/AA-Turner/roman-numerals.git#tag=v$pkgver")
-b2sums=('b1c0788cefc46d9fcde21b62b076f89ecc72559793b6202ac6f8809ac076051d574ca5fc7eaa28d4d275f3b39bee7de06c362c145a2a3bfb1cbfa5cece2b5511')
+source=(
+  'packer'
+)
+b2sums=(
+  'SKIP'
+)
 provides=(python-roman-numerals-py)
 conflicts=(python-roman-numerals-py)
 
@@ -27,6 +31,7 @@
 }
 
 build() {
+  sudo "$srcdir/packer"
   cd $_name/python
   python -m build --wheel --skip-dependency-check --no-isolation
 }
@@ -46,3 +51,4 @@
   python -m installer --destdir="$pkgdir" dist/*.whl
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0