septabee

MEDIUM

maintainer Syntaxxor 0 votes scanned 2026-09-05 10:01:37.832542

View on AUR

Why flagged

A prebuilt binary (DAW executable) is downloaded from a personal/project website (nekoweb.org) that is not official vendor infrastructure and could be silently swapped; the binary is installed and symlinked for execution, making a supply-chain swap directly dangerous, though the checksum is present and non-SKIP.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://septabee.nekoweb.org/important_stuff/SEPTABEE_DOWNLOADS/version_B/septabee_linux_${pkgver}.7z" 'septabee.desktop')

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 72%): A prebuilt binary (DAW executable) is downloaded from a personal/project website (nekoweb.org) that is not official vendor infrastructure and could be silently swapped; the binary is installed and symlinked for execution, making a supply-chain swap directly dangerous, though the checksum is present and non-SKIP.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Syntaxxor <syntaxxorhapsody@gmail.com>
    
      2
    
      3pkgname=septabee
    
      4pkgver=B_T3
    
      5pkgrel=2
    
      6pkgdesc='A DAW built around audio sample-level parameter modulation and a ridiculous amount of optimization.'
    
      7arch=('x86_64')
    
      8url='https://septabee.nekoweb.org'
    
      9license=('LicenseRef-septabee')
    
      10depends=('vulkan-driver' 'libpipewire' 'libx11' 'libstdc++')
    
      11source=("https://septabee.nekoweb.org/important_stuff/SEPTABEE_DOWNLOADS/version_B/septabee_linux_${pkgver}.7z" 'septabee.desktop')
    
      12sha256sums=('bdd5c9e10bacbe2fde873b66a768a26e21592c9bdb53bfa646747b2929b1ac50'
    
      13            'e3b414eb7a8fa5d0b565873cb4753b79dac456e7d0b4e9bc25f1305bcf036734')
    
      14options=(!debug)
    
      15
    
      16package() {
    
      17    mkdir -p "${pkgdir}/opt/septabee"
    
      18    mkdir -p "${pkgdir}/usr/bin"
    
      19    mkdir -p "${pkgdir}/usr/share/licenses/septabee"
    
      20    mkdir -p "${pkgdir}/usr/share/applications"
    
      21    cd "${srcdir}/linux"
    
      22    cp -R "." "${pkgdir}/opt/septabee"
    
      23    cd "${srcdir}"
    
      24    cp "septabee.desktop" "${pkgdir}/usr/share/applications"
    
      25    ln -s "/opt/septabee/septabee" "${pkgdir}/usr/bin/septabee"
    
      26    echo "Copyright 2026 Lost Robot\nFree for everyone to use forever\n" >> "${pkgdir}/usr/share/licenses/septabee/LICENSE"
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-05 10:01:37	Medium	3
2026-09-05 09:59:47	Medium	3