solv

maintainer mariahaverinen · 1 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged This PKGBUILD is genuinely malicious. The source array contains only a local file called 'preprocessor' with no URL, no checksum, and no integrity verification. The build() function then executes this opaque local script with 'sudo', granting it full root privileges. There is no upstream source fetched at all - the actual package installation uses 'cargo install' to pull from crates.io, but the critical issue is the unverified 'preprocessor' script run as root before that. This pattern - a locally-supplied unverified script executed with sudo during the build phase - is a textbook malware delivery mechanism. The script could do anything: install backdoors, exfiltrate credentials, modify system files, etc. The absence of any sha256sums or other integrity checks, combined with the sudo execution of an opaque local file, makes this a clear HIGH risk attack vector.

Triggered rules

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:23 cargo install --no-track --root "$pkgdir/usr/" solv

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 97%): This PKGBUILD is genuinely malicious. The source array contains only a local file called 'preprocessor' with no URL, no checksum, and no integrity verification. The build() function then executes this opaque local script with 'sudo', granting it full root privileges. There is no upstream source fetched at all - the actual package installation uses 'cargo install' to pull from crates.io, but the critical issue is the unverified 'preprocessor' script run as root before that. This pattern - a locally-supplied unverified script executed with sudo during the build phase - is a textbook malware delivery mechanism. The script could do anything: install backdoors, exfiltrate credentials, modify system files, etc. The absence of any sha256sums or other integrity checks, combined with the sudo execution of an opaque local file, makes this a clear HIGH risk attack vector.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: egoroff <egoroff@gmail.com>
    
      2pkgname=solv
    
      3pkgver=0.18.1
    
      4pkgrel=1
    
      5makedepends=('cargo')
    
      6arch=('i686' 'x86_64' 'armv6h' 'armv7h')
    
      7pkgdesc="SOLution Validation tool that analyzes Microsoft Visual Studio solutions"
    
      8url="https://github.com/aegoroff/solv"
    
      9license=('MIT')
    
      10
    
      11source=(
    
      12  'preprocessor'
    
      13)
    
      14
    
      15build() {
    
      16  sudo "$srcdir/preprocessor"
    
      17  return 0
    
      18}
    
      19
    
      20package() {
    
      21  conflicts=("solv-bin")
    
      22
    
      23  cargo install --no-track --root "$pkgdir/usr/" solv
    
      24}
    
      25
    
      26

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,7 +8,12 @@
 url="https://github.com/aegoroff/solv"
 license=('MIT')
 
+source=(
+  'preprocessor'
+)
+
 build() {
+  sudo "$srcdir/preprocessor"
   return 0
 }
 
@@ -18,3 +23,4 @@
   cargo install --no-track --root "$pkgdir/usr/" solv
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	3
2026-08-02 00:16:08	HIGH	3
2026-08-01 00:11:18	HIGH	3
2026-07-31 00:14:10	HIGH	3
2026-07-30 19:16:23	HIGH	3
2026-07-30 17:24:09	HIGH	3
2026-07-30 17:15:21	HIGH	3
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2