silentdragon-bin

maintainer jahway603 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from git.hush.is (a Gitea instance for the HUSH cryptocurrency project). While this is the project's own official forge rather than a random personal host, it is still a non-standard attachment URL (not a GitHub release or distro mirror), and the binary is installed directly without any extraction step shown for data.tar.xz from the .deb (the PKGBUILD references data.tar.xz but never unpacks the .deb first — though this may happen implicitly via makepkg's extract step or a missing prepare()). The sha512sums are present and pin the binary, which mitigates substitution risk significantly. The main residual concern is that git.hush.is is a self-hosted forge whose TLS and content integrity depend entirely on the project operators, and the binary is executed code installed to /usr/bin. This is a standard 'prebuilt binary from upstream's own forge' pattern common in AUR -bin packages; the sha512 checksum provides meaningful integrity protection. Overall this is a typical medium-risk -bin package: not clearly malicious, but carries inherent supply-chain risk from a prebuilt binary sourced from a self-hosted forge.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("$_pkgname-$pkgver-amd64.deb::https://git.hush.is/attachments/a2d8c2b9-67c4-4210-8b68-12c693c5260b"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from git.hush.is (a Gitea instance for the HUSH cryptocurrency project). While this is the project's own official forge rather than a random personal host, it is still a non-standard attachment URL (not a GitHub release or distro mirror), and the binary is installed directly without any extraction step shown for data.tar.xz from the .deb (the PKGBUILD references data.tar.xz but never unpacks the .deb first — though this may happen implicitly via makepkg's extract step or a missing prepare()). The sha512sums are present and pin the binary, which mitigates substitution risk significantly. The main residual concern is that git.hush.is is a self-hosted forge whose TLS and content integrity depend entirely on the project operators, and the binary is executed code installed to /usr/bin. This is a standard 'prebuilt binary from upstream's own forge' pattern common in AUR -bin packages; the sha512 checksum provides meaningful integrity protection. Overall this is a typical medium-risk -bin package: not clearly malicious, but carries inherent supply-chain risk from a prebuilt binary sourced from a self-hosted forge.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jah Way <jahway603 at protonmail dot com>
    
      2
    
      3pkgname=silentdragon-bin
    
      4_pkgname="${pkgname%-bin}"
    
      5pkgver=1.4.5
    
      6pkgrel=1
    
      7pkgdesc='HUSH (Privacy Cryptocurrency) desktop full node GUI wallet that supports z-addresses'
    
      8url='https://git.hush.is/hush/silentdragon'
    
      9arch=('x86_64')
    
      10license=('GPL-3.0-or-later')
    
      11makedepends=('curl' 'wget')
    
      12provides=('silentdragon')
    
      13conflicts=('silentdragon')
    
      14source=("$_pkgname-$pkgver-amd64.deb::https://git.hush.is/attachments/a2d8c2b9-67c4-4210-8b68-12c693c5260b"
    
      15        "$url/raw/branch/master/LICENSE")
    
      16sha512sums=('5faaff88755960d5c69521f6798711a486b319a2a33ccf6513d49401ac87b69574d571d86f8f534bc8f4922aac1c2b17ae93c128491440b3215cf3bf77004664'
    
      17            '2d3eac468855f3b7d5cec91c7af8119ba15b7c5f634642f4e10a7c69ab08f32d40b12eab8986cc8dbc80cbcd3d6697159723a25e56915f66ea50179caae69553')
    
      18
    
      19package() {
    
      20  install="${pkgbase}.install"
    
      21  # extract from deb file
    
      22  tar -xf "$srcdir/data.tar.xz"
    
      23
    
      24  install -Dm755 "$srcdir/usr/bin/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      25  install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      26  install -Dm644 "$srcdir/usr/share/applications/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      27  install -Dm644 "$srcdir/usr/share/pixmaps/$_pkgname.xpm" "$pkgdir/usr/share/pixmaps/$_pkgname.xpm"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2