stremio-service

LOW

maintainer rnbguy 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a source tarball from GitHub and a server.js file from dl.strem.io; the latter is a non-whitelisted but official Stremio domain used for legitimate service files, and both are verified via checksums, with no evidence of remote code execution or malicious behavior.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from GitHub and a server.js file from dl.strem.io; the latter is a non-whitelisted but official Stremio domain used for legitimate service files, and both are verified via checksums, with no evidence of remote code execution or malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "server.js::https://dl.strem.io/server/v4.20.17/desktop/server.js"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ranadeep B < mail at rnbguy dot at >
    
      2# Contributor: Ranadeep B < mail at rnbguy dot at >
    
      3
    
      4pkgname=stremio-service
    
      5pkgver=0.1.22
    
      6pkgrel=1
    
      7pkgdesc="The companion app of Stremio Web"
    
      8arch=('x86_64')
    
      9url='https://github.com/Stremio/stremio-service'
    
      10license=('GPL-2.0-only')
    
      11depends=(
    
      12  'bun'
    
      13  'cairo'
    
      14  'ffmpeg'
    
      15  'gcc-libs'
    
      16  'gdk-pixbuf2'
    
      17  'glib2'
    
      18  'glibc'
    
      19  'gtk3'
    
      20  'libayatana-appindicator'
    
      21)
    
      22makedepends=(
    
      23  'openssl'
    
      24  'pkgconf'
    
      25  'rust'
    
      26)
    
      27source=(
    
      28  "$pkgname-$pkgver.tar.gz::https://github.com/Stremio/stremio-service/archive/refs/tags/v$pkgver.tar.gz"
    
      29  "server.js::https://dl.strem.io/server/v4.20.17/desktop/server.js"
    
      30)
    
      31sha256sums=('fe24619250c4a854d7e7b5ef978fc8cf908cbc535be4f8de5155ebdb82c66855'
    
      32            '567a397bb11b788571bf1750fd05dd78927f97bec0c9ddeaa6d9cc1eccee3922')
    
      33
    
      34build() {
    
      35  cd "$srcdir/$pkgname-$pkgver"
    
      36
    
      37  cargo build --release --locked --features bundled,offline-build --bin stremio-service
    
      38}
    
      39
    
      40check() {
    
      41  cd "$srcdir/$pkgname-$pkgver"
    
      42
    
      43  cargo test --release --locked --features bundled,offline-build --lib --test copyright --bin stremio-service
    
      44}
    
      45
    
      46package() {
    
      47  cd "$srcdir/$pkgname-$pkgver"
    
      48
    
      49  install -Dm755 resources/stremio-service "$pkgdir/usr/bin/stremio-service"
    
      50  install -Dm755 target/release/stremio-service "$pkgdir/usr/share/stremio-service/stremio-service"
    
      51  install -Dm755 "$srcdir/server.js" "$pkgdir/usr/share/stremio-service/server.js"
    
      52
    
      53  ln -s /usr/bin/bun "$pkgdir/usr/share/stremio-service/stremio-runtime"
    
      54  ln -s /usr/bin/ffmpeg "$pkgdir/usr/share/stremio-service/ffmpeg"
    
      55  ln -s /usr/bin/ffprobe "$pkgdir/usr/share/stremio-service/ffprobe"
    
      56
    
      57  install -Dm644 LICENSE.md "$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
    
      58  install -Dm644 resources/com.stremio.service.desktop "$pkgdir/usr/share/applications/com.stremio.service.desktop"
    
      59  install -Dm644 resources/com.stremio.service.metainfo.xml "$pkgdir/usr/share/metainfo/com.stremio.service.metainfo.xml"
    
      60  install -Dm644 resources/com.stremio.service.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/com.stremio.service.svg"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2