socketsweep-bin

MEDIUM

maintainer jaytau 0 votes scanned 2026-09-08 13:17:19.099707

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release (unofficial host for binaries), which is unpacked and repackaged without verification of the source code or build process, posing a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release (unofficial host for binaries), which is unpacked and repackaged without verification of the source code or build process, posing a supply-chain risk.

PKGBUILD

      1# SPDX-License-Identifier: 0BSD
    
      2# Maintainer: jaytau <95355656+jay-tau@users.noreply.github.com>
    
      3
    
      4pkgname=socketsweep-bin
    
      5pkgver=1.1.0
    
      6pkgrel=1
    
      7pkgdesc='Android storage analyzer with an interactive treemap'
    
      8arch=('x86_64')
    
      9url='https://github.com/VishnuSrivatsava/SocketSweep'
    
      10license=('GPL-3.0-only')
    
      11depends=('android-tools' 'cairo' 'dbus' 'gdk-pixbuf2' 'glib2' 'glibc'
    
      12         'gtk3' 'hicolor-icon-theme' 'libgcc' 'libsoup3' 'webkit2gtk-4.1')
    
      13optdepends=('android-udev: additional udev rules for Android devices')
    
      14provides=("socketsweep=$pkgver")
    
      15conflicts=('socketsweep')
    
      16options=('!strip' '!debug')
    
      17source=("${url}/releases/download/v${pkgver}/SocketSweep_${pkgver}_amd64.deb")
    
      18sha256sums=('978d3d2fd692e457ea12c14ca70102c8a065d94cb7b11a63d8136999efb3a6cf')
    
      19
    
      20package() {
    
      21  bsdtar -xf data.tar.gz -C "$pkgdir"
    
      22  mv "$pkgdir/usr/bin/tauri-app" "$pkgdir/usr/bin/socketsweep"
    
      23  ln -sf /usr/bin/adb "$pkgdir/usr/lib/SocketSweep/bin/adb"
    
      24  for icon in "$pkgdir"/usr/share/icons/hicolor/*/apps/tauri-app.png; do
    
      25    mv "$icon" "${icon%tauri-app.png}socketsweep.png"
    
      26  done
    
      27  sed -i -e 's/=tauri-app$/=socketsweep/' \
    
      28         -e 's/^Categories=$/Categories=Utility;/' \
    
      29         -e "s/^Comment=.*/Comment=$pkgdesc/" \
    
      30         "$pkgdir/usr/share/applications/SocketSweep.desktop"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-08 13:17:19	Medium	2