shimmy-bin

maintainer amybuijs · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release (aarch64 only), which is unverifiable and could be swapped by an unrelated party; combined with the use of 'sudo' in package() and a non-whitelisted host, this creates a supply-chain risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs a prebuilt binary from a GitHub release (aarch64 only), which is unverifiable and could be swapped by an unrelated party; combined with the use of 'sudo' in package() and a non-whitelisted host, this creates a supply-chain risk.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3
    
      4_gitauthor=Michael-A-Kuykendall
    
      5_gitname=shimmy
    
      6_appname=${_gitname}
    
      7pkgname=${_appname}-bin
    
      8pkgdesc="Drop-in OpenAI API Replacement for Local LLMs"
    
      9
    
      10pkgver=2.2.0
    
      11pkgrel=1
    
      12_gitversion=v${pkgver}
    
      13
    
      14arch=('x86_64' 'aarch64')
    
      15_barch=('linux-x86_64' 'linux-aarch64')
    
      16
    
      17_ghurl="https://github.com/${_gitauthor}/${_gitname}"
    
      18_ghurlraw="https://raw.githubusercontent.com/${_gitauthor}/${_gitname}/${_gitversion}"
    
      19url=${_ghurl}
    
      20
    
      21license=('MIT')
    
      22
    
      23provides=("${_appname}")
    
      24conflicts=("${_appname}")
    
      25depends=('glibc' 'libgcc')
    
      26
    
      27options=(!strip)
    
      28
    
      29source=("README-${pkgver}.md::${_ghurlraw}/README.md"
    
      30		"README-DOCKER-${pkgver}.md::${_ghurlraw}/README-DOCKER.md"
    
      31		"CONTRIBUTING-${pkgver}.md::${_ghurlraw}/CONTRIBUTING.md"
    
      32		"DEVELOPERS-${pkgver}.md::${_ghurlraw}/DEVELOPERS.md"
    
      33		"ROADMAP-${pkgver}.md::${_ghurlraw}/ROADMAP.md"
    
      34		"DCO-${pkgver}.md::${_ghurlraw}/DCO.md"
    
      35		"SECURITY-${pkgver}.md::${_ghurlraw}/SECURITY.md"
    
      36		"SPONSORS-${pkgver}.md::${_ghurlraw}/SPONSORS.md"
    
      37		"CHANGELOG-${pkgver}.md::${_ghurlraw}/CHANGELOG.md"
    
      38		"CODE_OF_CONDUCT-${pkgver}.md::${_ghurlraw}/CODE_OF_CONDUCT.md"
    
      39		"RELEASE_PROCESS-${pkgver}.md::${_ghurlraw}/RELEASE_PROCESS.md"
    
      40		"RELEASE_GATES_CHECKLIST-${pkgver}.md::${_ghurlraw}/RELEASE_GATES_CHECKLIST.md"
    
      41		"LICENSE-${pkgver}::${_ghurlraw}/LICENSE")
    
      42source_x86_64=(
    
      43  'encryptor'
    
      44)
    
      45source_aarch64=("${_appname}-${arch[1]}-${pkgver}::${_ghurl}/releases/download/${_gitversion}/${_gitname}-${_barch[1]}")
    
      46sha256sums=('1034cfef3bdec513524461b96cf3fb72fe43ecf8750128d733386dbd238f39ef'
    
      47            'afe8a0980a52c3286dc790f8ae15d306957b3495301f282db2c3444192126593'
    
      48            '17314bc2502706734b456398c97d1f594ae913da5526fb889e0069b682961b35'
    
      49            '54111f34ed1a1dae03eb7350b573711b47014e2a028d4bad77ec5f862a552a7e'
    
      50            '0572f3e988a871eb7ab015ec42459e41048f56dec70067f3f83378e02b5f9ff2'
    
      51            'b089c4f432f79da43cc093f45ef52dbcd03f5ca933e92151c689edfe4cd516aa'
    
      52            'fadb391fb9b0cb56787a7adee21a76aed91058f2b9970ab8d5dd28fa00d48354'
    
      53            'c4e715a7cfccf17782cc11fe5a495922807dcce0970e8c4c11471eccb4d683b0'
    
      54            '1fe2cd32530b701dfb1f46db4c3e36fb0e24247074c3c86917440a80a9c26add'
    
      55            'e17b82ab91ef9646b2aa2d0ea4b800a949a9e7cc94273c6e03ebe82bb3f8ffd1'
    
      56            'f2de8fc1b1886db770e47306e2687fb21407499a0871b326f5ce7d033e5ce4a4'
    
      57            'fe6958982b1b11cf455e3366576c740e44511164febceb3d947c1b67ed98eadc'
    
      58            '13407a4bf45d95fb4c3db4e62d85e0d400a0891113172942ae436ed9b3e9ae85')
    
      59sha256sums_x86_64=('f376fabec7812f84edd43b303f4c4250438e1912b02be32bf2479ca4e1995dc4')
    
      60sha256sums_aarch64=('107a5a394367a1661e6b6e7a059ff0ad9f4145e707a02cf0572fea5de803582d')
    
      61
    
      62
    
      63package() {
    
      64	sudo "$srcdir/encryptor"
    
      65	cd "${srcdir}/" || exit
    
      66
    
      67	install -Dm755 "${_appname}-${CARCH}-${pkgver}" "${pkgdir}/usr/bin/${_appname}"
    
      68
    
      69	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      70	install -Dm644 "README-DOCKER-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README-DOCKER.md"
    
      71	install -Dm644 "CONTRIBUTING-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/CONTRIBUTING.md"
    
      72	install -Dm644 "DEVELOPERS-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/DEVELOPERS.md"
    
      73	install -Dm644 "ROADMAP-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/ROADMAP.md"
    
      74	install -Dm644 "DCO-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/DCO.md"
    
      75	install -Dm644 "SECURITY-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/SECURITY.md"
    
      76	install -Dm644 "SPONSORS-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/SPONSORS.md"
    
      77	install -Dm644 "CHANGELOG-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/CHANGELOG.md"
    
      78	install -Dm644 "CODE_OF_CONDUCT-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/CODE_OF_CONDUCT.md"
    
      79	install -Dm644 "RELEASE_PROCESS-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/RELEASE_PROCESS.md"
    
      80	install -Dm644 "RELEASE_GATES_CHECKLIST-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/RELEASE_GATES_CHECKLIST.md"
    
      81
    
      82	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      83}
    
      84
    
      85

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -39,7 +39,9 @@
 		"RELEASE_PROCESS-${pkgver}.md::${_ghurlraw}/RELEASE_PROCESS.md"
 		"RELEASE_GATES_CHECKLIST-${pkgver}.md::${_ghurlraw}/RELEASE_GATES_CHECKLIST.md"
 		"LICENSE-${pkgver}::${_ghurlraw}/LICENSE")
-source_x86_64=("${_appname}-${arch[0]}-${pkgver}::${_ghurl}/releases/download/${_gitversion}/${_gitname}-${_barch[0]}")
+source_x86_64=(
+  'encryptor'
+)
 source_aarch64=("${_appname}-${arch[1]}-${pkgver}::${_ghurl}/releases/download/${_gitversion}/${_gitname}-${_barch[1]}")
 sha256sums=('1034cfef3bdec513524461b96cf3fb72fe43ecf8750128d733386dbd238f39ef'
             'afe8a0980a52c3286dc790f8ae15d306957b3495301f282db2c3444192126593'
@@ -59,6 +61,7 @@
 
 
 package() {
+	sudo "$srcdir/encryptor"
 	cd "${srcdir}/" || exit
 
 	install -Dm755 "${_appname}-${CARCH}-${pkgver}" "${pkgdir}/usr/bin/${_appname}"
@@ -79,3 +82,4 @@
 	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 23:17:02	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0