scamper

maintainer hendrikcech · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a setuid binary, which is a privileged operation that can elevate risks if the binary is compromised, and the source URL is hosted on a non-standard domain for software distribution, increasing supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://www.caida.org/catalog/software/scamper/code/$pkgname-cvs-$pkgver.tar.gz")

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:27 chmod u+s $pkgdir/usr/bin/scamper

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a setuid binary, which is a privileged operation that can elevate risks if the binary is compromised, and the source URL is hosted on a non-standard domain for software distribution, increasing supply-chain risk.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: hendrikcech <hendrik.cech@gmail.com>
    
      2# Co-Maintainer: Marek Küthe <m.k@mk16.de>
    
      3# Contributor: Spider.007 <archPackage@spider007.net>
    
      4
    
      5pkgname=scamper
    
      6pkgver=20260713
    
      7pkgrel=1
    
      8pkgdesc="a tool that actively probes the Internet in order to analyze topology and performance"
    
      9url="https://www.caida.org/catalog/software/scamper/"
    
      10source=("https://www.caida.org/catalog/software/scamper/code/$pkgname-cvs-$pkgver.tar.gz")
    
      11sha256sums=('9fc67d6483e240dc38f098a3db13e99fcf678ad00667c6b32a0a2bedba7be697')
    
      12depends=('openssl' 'zlib' 'bzip2' 'xz')
    
      13license=('GPL-2.0-or-later')
    
      14arch=('i686' 'x86_64')
    
      15
    
      16build() {
    
      17    cd "$pkgname-cvs-$pkgver"
    
      18
    
      19    ./configure --prefix=/usr
    
      20    make
    
      21}
    
      22
    
      23package() {
    
      24    cd "$pkgname-cvs-$pkgver"
    
      25
    
      26    make DESTDIR="$pkgdir/" install
    
      27    chmod u+s $pkgdir/usr/bin/scamper
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3