quickoverflow

maintainer spaciouscoder78 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs Python dependencies via 'pipenv run pip install -r requirements.txt' where requirements.txt comes from the tarball source (not separately listed/checksummed in the source array). While the tarball itself has an md5sum, the requirements.txt inside it could pin arbitrary PyPI packages that get downloaded at build time without independent verification. Additionally, pyinstaller bundles the result into a single binary, obscuring what's actually being installed. The 'sudo' calls inside package() are a serious packaging error (makepkg already runs as a user, and sudo in package() is wrong/dangerous). The installed binary is named 'search' which is an extremely generic name that could shadow system utilities. These are real supply-chain and packaging concerns: unreviewed pip dependencies fetched at build time, a bundled opaque binary, and misuse of sudo. Not clearly malicious but a genuine medium-risk concern.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:18 pipenv run pip install -r requirements.txt

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs Python dependencies via 'pipenv run pip install -r requirements.txt' where requirements.txt comes from the tarball source (not separately listed/checksummed in the source array). While the tarball itself has an md5sum, the requirements.txt inside it could pin arbitrary PyPI packages that get downloaded at build time without independent verification. Additionally, pyinstaller bundles the result into a single binary, obscuring what's actually being installed. The 'sudo' calls inside package() are a serious packaging error (makepkg already runs as a user, and sudo in package() is wrong/dangerous). The installed binary is named 'search' which is an extremely generic name that could shadow system utilities. These are real supply-chain and packaging concerns: unreviewed pip dependencies fetched at build time, a bundled opaque binary, and misuse of sudo. Not clearly malicious but a genuine medium-risk concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: SpaciousCoder78 <aryankmmiv@outlook.com>
    
      2pkgname=quickoverflow
    
      3pkgver=3.0.0
    
      4pkgrel=1
    
      5pkgdesc="A CLI Tool to auto-detect code errors and open solutions"
    
      6arch=('x86_64')
    
      7url="https://github.com/SpaciousCoder78/QuickOverflow"
    
      8license=('GPL3')
    
      9depends=('python')
    
      10makedepends=('python-pipenv' 'python-pip' 'gcc')
    
      11source=("https://github.com/SpaciousCoder78/QuickOverflow/releases/download/v3.0.0/QuickOverflow3.0.0.tar.gz")
    
      12md5sums=('3812a9438f234df57e26f75a7b9e4dc1')
    
      13
    
      14build() {
    
      15    cd "$srcdir/pyoverflow-cli"
    
      16    if [[ -f Pipfile ]]; then
    
      17        pipenv install --python python3
    
      18        pipenv run pip install -r requirements.txt
    
      19        pipenv install pyinstaller
    
      20    fi
    
      21
    
      22    gcc main.c -o quickoverflow
    
      23    chmod +x search.py
    
      24    pipenv run pyinstaller --onefile --name search search.py
    
      25}
    
      26
    
      27package() {
    
      28    cd "$srcdir/pyoverflow-cli"
    
      29    sudo install -Dm755 quickoverflow "/usr/local/bin/quickoverflow"
    
      30    sudo install -Dm755 dist/search "/usr/local/bin/search"
    
      31}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2