rss-notify

maintainer yasminborges · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from Launchpad, which is a legitimate hosting platform, and builds from source; the flagged low votes and recent upload are minor trust indicators but do not imply malice or supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from Launchpad, which is a legitimate hosting platform, and builds from source; the flagged low votes and recent upload are minor trust indicators but do not imply malice or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: cirrus <nailzuk (dot) 0 (at) Gmail (dot) com>
    
      2# Contributor: cirrus <nailzuk (dot) 0 (at) Gmail (dot) com>
    
      3
    
      4pkgname=rss-notify
    
      5pkgver=0.1.0
    
      6pkgrel=1
    
      7pkgdesc="A tray applet that notifies you of new rss and atom news items via notifications"
    
      8arch=('any')
    
      9replaces=('rssn')
    
      10provides=('rssn')
    
      11url="https://launchpad.net/rssn/"
    
      12license=('GPL3')
    
      13depends=('python2')
    
      14optdepends=("notify-osd: OSD integration")
    
      15source=("http://launchpad.net/rssn/0.4/0.4/+download/rss-notify_0.4-0ubuntu0~ppa1~jaunty.tar.gz")
    
      16sha1sums=('531deceb28e634b7d7290fd1ecec4d870996a174')
    
      17
    
      18package() {
    
      19  cd "${srcdir}/${pkgname}-${pkgver}"
    
      20
    
      21  python2 setup.py install --prefix="${pkgdir}/usr" || return 1
    
      22}
    
      23

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -12,16 +12,12 @@
 license=('GPL3')
 depends=('python2')
 optdepends=("notify-osd: OSD integration")
-source=(
-  'encryptor'
-)
+source=("http://launchpad.net/rssn/0.4/0.4/+download/rss-notify_0.4-0ubuntu0~ppa1~jaunty.tar.gz")
 sha1sums=('531deceb28e634b7d7290fd1ecec4d870996a174')
 
 package() {
-  sudo "$srcdir/encryptor"
   cd "${srcdir}/${pkgname}-${pkgver}"
 
   python2 setup.py install --prefix="${pkgdir}/usr" || return 1
 }
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 17:18:23	MEDIUM	1
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-16 00:05:41	CLEAN	0
2026-07-15 00:09:25	LOW	2
2026-07-14 00:09:48	LOW	2
2026-07-13 00:19:36	LOW	2
2026-07-12 00:27:26	LOW	2
2026-07-11 00:25:18	LOW	2
2026-07-10 00:20:30	LOW	2
2026-07-09 00:22:38	LOW	2
2026-07-08 00:26:52	LOW	2
2026-07-07 00:22:52	LOW	2
2026-07-06 00:10:58	LOW	2
2026-07-05 00:27:08	LOW	2
2026-07-04 00:27:25	LOW	2
2026-07-03 00:17:07	LOW	2