splayer-next-bin

maintainer K-Black · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release hosted by a third party, which is not the official project repository, creating a supply-chain risk if the source is compromised or swapped.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release hosted by a third party, which is not the official project repository, creating a supply-chain risk if the source is compromised or swapped.

PKGBUILD

      1# Maintainer: imsyy <imsyy1024@gmail.com>
    
      2pkgname=splayer-next-bin
    
      3pkgver=1.0.0
    
      4pkgrel=2
    
      5pkgdesc="A modern cross-platform music player built with Electron, Vue 3, and TypeScript (unofficial build)"
    
      6arch=('x86_64')
    
      7url="https://splayer.imsyy.top"
    
      8license=('AGPL-3.0')
    
      9depends=(
    
      10  'c-ares'
    
      11  'ffmpeg'
    
      12  'gtk3'
    
      13  'http-parser'
    
      14  'libevent'
    
      15  'libvpx'
    
      16  'libxslt'
    
      17  'libxss'
    
      18  'minizip'
    
      19  'nss'
    
      20  're2'
    
      21  'snappy'
    
      22  'libnotify'
    
      23  'libappindicator-gtk3'
    
      24)
    
      25source=("https://github.com/K-Blaaaack/SPlayer-Next/releases/download/v${pkgver}/splayer-next-${pkgver}-x64.pacman")
    
      26sha256sums=('7fda6ec459937e07f1b7e3346990e482a2d22809a37159a21f0b8971f8945a41')
    
      27
    
      28package() {
    
      29  bsdtar -xf "$srcdir/splayer-next-${pkgver}-x64.pacman" --exclude='.*' -C "$pkgdir" --no-same-permissions --no-same-owner
    
      30  mv "$pkgdir/opt/SPlayer-Next" "$pkgdir/opt/splayer-next" 2>/dev/null || true
    
      31  ln -sf "/opt/splayer-next/SPlayer-Next" "$pkgdir/usr/bin/splayer-next" 2>/dev/null || true
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 13:38:59	MEDIUM	2