qtum-core-bin

maintainer mikehash · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads and installs a prebuilt binary .deb from repo.qtum.info. While this appears to be an official Qtum project subdomain (the maintainer email is @qtum.org and the url field points to qtum.org), repo.qtum.info is a separate host not verifiable as the canonical upstream release location (which is typically GitHub releases at github.com/qtumproject/qtum). The binary is executed directly on the user's system without any source build, and the sha256sum provides only integrity checking against a potentially compromised host. This is a legitimate supply-chain concern: if repo.qtum.info is a separate infrastructure from the primary release pipeline, a compromise there would not be caught. However, the domain relationship (qtum.info vs qtum.org) and the maintainer's qtum.org email suggest this is likely official infrastructure. The risk is real but not clearly malicious — a medium rating is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://repo.qtum.info/apt/ubuntu/pool/main/q/qtum/qtum_0.27.1_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads and installs a prebuilt binary .deb from repo.qtum.info. While this appears to be an official Qtum project subdomain (the maintainer email is @qtum.org and the url field points to qtum.org), repo.qtum.info is a separate host not verifiable as the canonical upstream release location (which is typically GitHub releases at github.com/qtumproject/qtum). The binary is executed directly on the user's system without any source build, and the sha256sum provides only integrity checking against a potentially compromised host. This is a legitimate supply-chain concern: if repo.qtum.info is a separate infrastructure from the primary release pipeline, a compromise there would not be caught. However, the domain relationship (qtum.info vs qtum.org) and the maintainer's qtum.org email suggest this is likely official infrastructure. The risk is real but not clearly malicious — a medium rating is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: "mikehash" Miguel Palencia mike@qtum.org
    
      2	
    
      3
    
      4
    
      5pkgname=qtum-core-bin
    
      6pkgver=0.27.1
    
      7pkgrel=4
    
      8pkgdesc="Qtum Desktop Binary release"
    
      9arch=('x86_64')
    
      10url="https://qtum.org"
    
      11license=('GPL-3.0')
    
      12depends=(glibc)
    
      13source=("https://repo.qtum.info/apt/ubuntu/pool/main/q/qtum/qtum_0.27.1_amd64.deb")
    
      14sha256sums=('2df512d650c14ba6471a011a6aa3d97df7c342c5cd9d40be7ab40e6c987c6761')
    
      15
    
      16package() {
    
      17    bsdtar -O -xf qtum_0.27.1_amd64.deb data.tar.xz | bsdtar -C "${pkgdir}" -xJf - 
    
      18    find "${pkgdir}" -type d -exec chmod 755 {} +
    
      19
    
      20}
    
      21

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2