splayer-forge

maintainer Nk_YMZ · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release hosted on a personal account without verifiable build scripts, creating a supply-chain risk if the source were compromised.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release hosted on a personal account without verifiable build scripts, creating a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: Nk-YMZ <village_flute@outlook.com>
    
      2
    
      3pkgname=splayer-forge
    
      4pkgver=3.1.1
    
      5pkgrel=5
    
      6epoch=1
    
      7pkgdesc="SPlayer Forge - 修复播放队列的 SPlayer 社区构建"
    
      8arch=('x86_64')
    
      9url="https://github.com/Nk-YMZ/SPlayer-Forge"
    
      10license=('AGPL-3.0-only')
    
      11depends=(
    
      12  'c-ares'
    
      13  'ffmpeg'
    
      14  'gtk3'
    
      15  'libevent'
    
      16  'libnotify'
    
      17  'libvips'
    
      18  'libvpx'
    
      19  'libxslt'
    
      20  'libxss'
    
      21  'minizip'
    
      22  'nss'
    
      23  're2'
    
      24  'snappy'
    
      25)
    
      26optdepends=(
    
      27  'libappindicator: 系统托盘图标支持'
    
      28  'mpv: MPV 播放引擎支持'
    
      29)
    
      30provides=("splayer=${pkgver}")
    
      31conflicts=('splayer')
    
      32options=('!strip' '!debug')
    
      33install=splayer-forge.install
    
      34source=("splayer-${pkgver}-${pkgrel}-x64.pkg.tar.zst::https://github.com/Nk-YMZ/SPlayer-Forge/releases/download/arch-v${pkgver}-${pkgrel}/splayer-${pkgver}-x64.pkg.tar.zst")
    
      35noextract=("splayer-${pkgver}-${pkgrel}-x64.pkg.tar.zst")
    
      36sha256sums=('00177ca3220c71c5646aea708ff7fca1bdb5b60f41932bb1669543c3f4afedba')
    
      37
    
      38package() {
    
      39  bsdtar -xf "${srcdir}/splayer-${pkgver}-${pkgrel}-x64.pkg.tar.zst" \
    
      40    -C "${pkgdir}" \
    
      41    --exclude='.BUILDINFO' \
    
      42    --exclude='.INSTALL' \
    
      43    --exclude='.MTREE' \
    
      44    --exclude='.PKGINFO'
    
      45
    
      46  install -d "${pkgdir}/usr/bin"
    
      47  ln -s '/opt/SPlayer/SPlayer' "${pkgdir}/usr/bin/SPlayer"
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 21:12:47	MEDIUM	2