pyvmmonitor

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt proprietary binaries (a Python profiler with a UI) from Mediafire, a personal/generic file-sharing host rather than an official vendor release server or well-known mirror. The binaries are installed directly into /opt and symlinked into /usr/bin, meaning they execute with user privileges. While checksums (MD5) are present, MD5 is cryptographically weak and Mediafire links can be replaced by the uploader at any time without changing the URL, making the checksums the only integrity barrier. The official pyvmmonitor.com site does exist and the software is real, but distributing via Mediafire rather than the vendor's own download infrastructure is a genuine supply-chain concern: the file could be swapped for a malicious binary and the MD5 could be updated in the PKGBUILD without obvious red flags. This is a textbook medium-severity supply-chain risk: executed binary from an unofficial/personal host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_i686=(http://www.mediafire.com/download/$_hash32/${pkgname}_${pkgver}_linux.x86.tar.gz)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads prebuilt proprietary binaries (a Python profiler with a UI) from Mediafire, a personal/generic file-sharing host rather than an official vendor release server or well-known mirror. The binaries are installed directly into /opt and symlinked into /usr/bin, meaning they execute with user privileges. While checksums (MD5) are present, MD5 is cryptographically weak and Mediafire links can be replaced by the uploader at any time without changing the URL, making the checksums the only integrity barrier. The official pyvmmonitor.com site does exist and the software is real, but distributing via Mediafire rather than the vendor's own download infrastructure is a genuine supply-chain concern: the file could be swapped for a malicious binary and the MD5 could be updated in the PKGBUILD without obvious red flags. This is a textbook medium-severity supply-chain risk: executed binary from an unofficial/personal host.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Daniel Milde <daniel@milde.cz>
    
      2
    
      3pkgname=pyvmmonitor
    
      4pkgver=1.1.2
    
      5pkgrel=1
    
      6_hash64=qdz3f2vs31a42z6
    
      7_hash32=9smdc57z9yshc3a
    
      8pkgdesc="Profiler with a simple goal: being the best way to profile a Python program."
    
      9arch=(i686 x86_64)
    
      10url="http://www.pyvmmonitor.com/"
    
      11license=('custom')
    
      12depends=('python-yappi')
    
      13source_i686=(http://www.mediafire.com/download/$_hash32/${pkgname}_${pkgver}_linux.x86.tar.gz)
    
      14source_x86_64=(http://www.mediafire.com/download/$_hash64/${pkgname}_${pkgver}_linux.x86_64.tar.gz)
    
      15md5sums_i686=('09e154b06fad5d33bb85b0658eac95d9')
    
      16md5sums_x86_64=('bc1c554c74d5f7639a8540f1e26bc1c5')
    
      17
    
      18
    
      19package() {
    
      20	cd $srcdir
    
      21	
    
      22	install -d $pkgdir/opt
    
      23	install -d $pkgdir/usr
    
      24	install -d $pkgdir/usr/bin
    
      25	
    
      26	cp -R $pkgname $pkgdir/opt
    
      27	ln -s /opt/pyvmmonitor/pyvmmonitor-ui $pkgdir/usr/bin/pyvmmonitor-ui
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2