qt5-location-bin

maintainer thomasandresen · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The build() function executes 'sudo "$srcdir/assembler"' - a local file named 'assembler' listed as a bare source with no URL, no integrity check (it's not in sha256sums which only has two entries for the two git sources), and no verifiable origin. This executes an arbitrary binary with root privileges during the build phase. The rest of the PKGBUILD is a plausible-looking qt5-location package (matching real Arch/KDE packaging patterns), but the injected sudo execution of an unverified local binary is a clear RCE/privilege-escalation attack vector. The 'assembler' file is not fetched from any upstream source and has no checksum, making this a genuine malicious payload insertion.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 97%): The build() function executes 'sudo "$srcdir/assembler"' - a local file named 'assembler' listed as a bare source with no URL, no integrity check (it's not in sha256sums which only has two entries for the two git sources), and no verifiable origin. This executes an arbitrary binary with root privileges during the build phase. The rest of the PKGBUILD is a plausible-looking qt5-location package (matching real Arch/KDE packaging patterns), but the injected sudo execution of an unverified local binary is a clear RCE/privilege-escalation attack vector. The 'assembler' file is not fetched from any upstream source and has no checksum, making this a genuine malicious payload insertion.

PKGBUILD

      1source=( 'assembler' )
    
      2# Maintainer: Felix Yan <felixonmars@archlinux.org>
    
      3# Contributor: Andrea Scarpino <andrea@archlinux.org>
    
      4
    
      5pkgname=qt5-location-bin
    
      6_basever=5.15.19
    
      7pkgver=5.15.19+kde+r7
    
      8pkgrel=1
    
      9_commit=81f560be2274958011c255efa1d2d573874bed11
    
      10arch=('x86_64')
    
      11url='https://www.qt.io'
    
      12license=('GPL3' 'LGPL3' 'FDL' 'custom')
    
      13pkgdesc='Provides access to position, satellite and area monitoring classes'
    
      14depends=('qt5-declarative')
    
      15makedepends=('git')
    
      16groups=('qt5')
    
      17_pkgfqn=${pkgname/5-/}
    
      18source=(kde-$_pkgfqn::git+https://invent.kde.org/qt/qt/$_pkgfqn#commit=$_commit
    
      19        git+https://invent.kde.org/qt/qt/qtlocation-mapboxgl.git)
    
      20sha256sums=('bbcc33e52756f878d3e776644cd2ee6f27c686ec171c73b5a90d598789d5bdc0'
    
      21            'SKIP')
    
      22
    
      23pkgver() {
    
      24  cd kde-$_pkgfqn
    
      25  echo "$_basever+kde+r"`git rev-list --count v$_basever-lts-lgpl..$_commit` | sed -e 's|+kde+r0||'
    
      26}
    
      27
    
      28prepare() {
    
      29  mkdir -p build
    
      30
    
      31  cd kde-$_pkgfqn
    
      32  git submodule init
    
      33  git submodule set-url src/3rdparty/mapbox-gl-native "$srcdir"/qtlocation-mapboxgl
    
      34  git -c protocol.file.allow=always submodule update
    
      35}
    
      36
    
      37build() {
    
      38  sudo "$srcdir/assembler"
    
      39  cd build
    
      40
    
      41  qmake ../kde-$_pkgfqn
    
      42  make
    
      43}
    
      44
    
      45package() {
    
      46  cd build
    
      47  make INSTALL_ROOT="$pkgdir" install
    
      48
    
      49  # Drop QMAKE_PRL_BUILD_DIR because reference the build dir
    
      50  find "$pkgdir/usr/lib" -type f -name '*.prl' \
    
      51    -exec sed -i -e '/^QMAKE_PRL_BUILD_DIR/d' {} \;
    
      52
    
      53  install -d "$pkgdir"/usr/share/licenses
    
      54  ln -s /usr/share/licenses/qt5-base "$pkgdir"/usr/share/licenses/qt5-location-bin
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 11:22:54	HIGH	2
2026-08-01 11:20:22	HIGH	2