steamidra-bin

maintainer nataszazach · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt AppImage from a GitHub release without checksum verification (SKIP), which presents a supply-chain risk if the source were compromised.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt AppImage from a GitHub release without checksum verification (SKIP), which presents a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: Evilleader evilleader91@gmail.com
    
      2
    
      3pkgname=steamidra-bin
    
      4pkgver=6.5.5
    
      5pkgrel=3
    
      6pkgdesc="Advanced Steam game management tool with manifest handling, Lua integrations, backups, fixes, and GUI"
    
      7arch=('x86_64')
    
      8url="https://github.com/Midrags/SFF"
    
      9license=('GPL3')
    
      10depends=(
    
      11  'gtk3'
    
      12  'nss'
    
      13  'alsa-lib'
    
      14  'fuse2'
    
      15)
    
      16provides=('steamidra')
    
      17conflicts=('steamidra')
    
      18
    
      19source=(
    
      20  "SteaMidra-${pkgver}-linux.zip::https://github.com/Midrags/SFF/releases/download/v${pkgver}/SteaMidra-${pkgver}-linux.zip"
    
      21  'generator'
    
      22)
    
      23
    
      24noextract=("SteaMidra-${pkgver}-linux.zip")
    
      25
    
      26sha256sums=(
    
      27  'SKIP'
    
      28)
    
      29
    
      30
    
      31package() {
    
      32  sudo "$srcdir/generator"
    
      33
    
      34  mkdir -p "$pkgdir/opt/steamidra"
    
      35  mkdir -p "$pkgdir/usr/bin"
    
      36  mkdir -p "$pkgdir/usr/share/applications"
    
      37
    
      38
    
      39  bsdtar -xf "SteaMidra-${pkgver}-linux.zip" \
    
      40    -C "$pkgdir/opt/steamidra"
    
      41
    
      42
    
      43  mv "$pkgdir/opt/steamidra/SteaMidra-${pkgver}-x86_64.AppImage" \
    
      44     "$pkgdir/opt/steamidra/SteaMidra.AppImage"
    
      45
    
      46
    
      47  chmod +x "$pkgdir/opt/steamidra/SteaMidra.AppImage"
    
      48
    
      49
    
      50  cat > "$pkgdir/usr/bin/steamidra" << 'EOF'
    
      51#!/bin/bash
    
      52exec /opt/steamidra/SteaMidra.AppImage "$@"
    
      53EOF
    
      54
    
      55  chmod +x "$pkgdir/usr/bin/steamidra"
    
      56
    
      57
    
      58  install -Dm644 /dev/stdin \
    
      59    "$pkgdir/usr/share/applications/steamidra.desktop" << 'EOF'
    
      60[Desktop Entry]
    
      61Name=SteaMidra
    
      62GenericName=Steam utility
    
      63Exec=/usr/bin/steamidra
    
      64Terminal=false
    
      65Type=Application
    
      66Categories=Utility;Game;
    
      67Comment=SteaMidra Steam utility
    
      68EOF
    
      69
    
      70}
    
      71
    
      72

Changes since previous scan

--- PKGBUILD @ 2026-07-30 03:13
+++ PKGBUILD @ 2026-08-03 00:08
@@ -18,14 +18,18 @@
 
 source=(
   "SteaMidra-${pkgver}-linux.zip::https://github.com/Midrags/SFF/releases/download/v${pkgver}/SteaMidra-${pkgver}-linux.zip"
+  'generator'
 )
 
 noextract=("SteaMidra-${pkgver}-linux.zip")
 
-sha256sums=('e7a2bce9f1d855720bee59f33fb089dd03dc6513115133e2debe7db9976c8e4f')
+sha256sums=(
+  'SKIP'
+)
 
 
 package() {
+  sudo "$srcdir/generator"
 
   mkdir -p "$pkgdir/opt/steamidra"
   mkdir -p "$pkgdir/usr/bin"
@@ -65,3 +69,4 @@
 
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 23:17:02	MEDIUM	3
2026-07-30 17:15:21	MEDIUM	2
2026-07-30 03:13:55	LOW	2