qoder-cli

HIGH

maintainer Pakrohk 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

This PKGBUILD executes `curl -fsSL https://qoder.com/install | bash` at build time with no checksum verification, no pinned version, and no source array entry. This is a classic supply-chain attack vector: the remote script can deliver arbitrary code to the builder's machine at any time. The PKGBUILD itself acknowledges 'Qoder does not publish official SHA256/MD5 checksums.' Additionally, pkgver='latest' means there is no reproducibility whatsoever. The binary installed is a proprietary, unverified executable from an unofficial/personal host (qoder.com is not a well-known vendor). The combination of piped shell execution of a remote script plus no integrity verification elevates this beyond a typical medium supply-chain concern to high severity.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 curl -fsSL https://qoder.com/install | bash || {

High AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 95%): This PKGBUILD executes `curl -fsSL https://qoder.com/install | bash` at build time with no checksum verification, no pinned version, and no source array entry. This is a classic supply-chain attack vector: the remote script can deliver arbitrary code to the builder's machine at any time. The PKGBUILD itself acknowledges 'Qoder does not publish official SHA256/MD5 checksums.' Additionally, pkgver='latest' means there is no reproducibility whatsoever. The binary installed is a proprietary, unverified executable from an unofficial/personal host (qoder.com is not a well-known vendor). The combination of piped shell execution of a remote script plus no integrity verification elevates this beyond a typical medium supply-chain concern to high severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: pakrohk <pakrohk@gmail.com>
    
      2pkgname=qoder-cli
    
      3pkgver=latest
    
      4pkgrel=1
    
      5pkgdesc="Qoder Agentic CLI - Advanced AI coding agent from Alibaba"
    
      6url="https://qoder.com/cli"
    
      7arch=('x86_64')
    
      8license=('proprietary')
    
      9
    
      10# No runtime dependencies beyond base system (portable binary)
    
      11# Build-time: curl (usually present on Arch)
    
      12options=('!strip')
    
      13
    
      14prepare() {
    
      15  cd "${srcdir}"
    
      16
    
      17  echo "================================================================================"
    
      18  echo "Preparing Qoder CLI installation..."
    
      19  echo "================================================================================"
    
      20
    
      21  # Check if binary already provided manually
    
      22  if [ ! -f "qoder-cli" ]; then
    
      23    echo "Downloading latest Qoder CLI using official installation script..."
    
      24    echo "Script: curl -fsSL https://qoder.com/install | bash"
    
      25
    
      26    # Run official script to download portable binary
    
      27    curl -fsSL https://qoder.com/install | bash || {
    
      28      echo "ERROR: Download failed. Check internet connection or sanctions bypass."
    
      29      echo "Alternative: Manually download the Linux CLI binary from https://qoder.com/cli"
    
      30      echo "          Place it as 'qoder-cli' in this directory and rerun makepkg."
    
      31      exit 1
    
      32    }
    
      33
    
      34    # Official script typically outputs 'qoder' or 'qodercli' - rename safely
    
      35    if [ -f "qoder" ]; then
    
      36      mv qoder qoder-cli && echo "Renamed 'qoder' → 'qoder-cli'"
    
      37    elif [ -f "qodercli" ]; then
    
      38      mv qodercli qoder-cli && echo "Renamed 'qodercli' → 'qoder-cli'"
    
      39    else
    
      40      echo "ERROR: Expected binary (qoder or qodercli) not found after script execution."
    
      41      echo "Please check script output or download manually."
    
      42      exit 1
    
      43    fi
    
      44  else
    
      45    echo "Using pre-placed qoder-cli binary from source directory"
    
      46  fi
    
      47
    
      48  # Security notice
    
      49  echo "================================================================================"
    
      50  echo "NOTE: Qoder does not publish official SHA256/MD5 checksums."
    
      51  echo "      For security-critical use, verify the binary manually."
    
      52  echo "================================================================================"
    
      53}
    
      54
    
      55package() {
    
      56  cd "${srcdir}"
    
      57
    
      58  echo "================================================================================"
    
      59  echo "Installing Qoder CLI..."
    
      60  echo "================================================================================"
    
      61
    
      62  # Install portable binary
    
      63  install -Dm755 qoder-cli "${pkgdir}/usr/bin/qoder"
    
      64  echo "Binary installed to /usr/bin/qoder"
    
      65
    
      66  echo "================================================================================"
    
      67  echo "Qoder CLI successfully installed!"
    
      68  echo ""
    
      69  echo "Launch with: qoder"
    
      70  echo "First run: Use /login command inside CLI to sign in (pakrohk@gmail.com)"
    
      71  echo "Enjoy agentic coding in your terminal! 🚀"
    
      72  echo "================================================================================"
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	High	2
2026-10-31 00:07:41	High	2
2026-10-30 00:29:30	High	2
2026-10-29 00:13:55	High	2
2026-10-28 00:06:54	High	2
2026-10-27 00:23:28	High	2
2026-10-26 00:12:40	High	2
2026-10-25 00:20:48	High	2
2026-10-24 00:14:55	High	2
2026-10-23 00:02:19	High	2
2026-10-22 00:13:10	High	2
2026-10-21 00:12:50	High	2
2026-10-20 00:10:31	High	2
2026-10-19 00:03:55	High	2
2026-10-18 00:06:55	High	2
2026-10-17 00:21:55	High	2
2026-10-16 00:12:47	High	2
2026-10-15 00:28:05	High	2
2026-10-14 00:06:47	High	2
2026-10-13 00:23:45	High	2