termimage-bin

maintainer orhun · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt amd64 .deb binary from debian.nabijaczleweli.xyz, which is the upstream author's (nabijaczleweli) personal Debian repository rather than an official distribution mirror or GitHub Releases. While this is the same author as the upstream project (github.com/nabijaczleweli/termimage), it is still a personal hosting infrastructure that is not subject to the same integrity guarantees as GitHub Releases or official distro repos. A compromise of that server or DNS would result in arbitrary binary execution on the user's system. The sha512sums provide some protection against in-transit tampering but not against the host serving a malicious binary from the start. This is a genuine supply-chain concern: an executed binary from a personal/unofficial host. The pattern is common in AUR -bin packages but the risk is real and warrants medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_x86_64=("https://debian.nabijaczleweli.xyz/pool/main/t/${pkgname%-bin}/${pkgname%-bin}_${pkgver}-1_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt amd64 .deb binary from debian.nabijaczleweli.xyz, which is the upstream author's (nabijaczleweli) personal Debian repository rather than an official distribution mirror or GitHub Releases. While this is the same author as the upstream project (github.com/nabijaczleweli/termimage), it is still a personal hosting infrastructure that is not subject to the same integrity guarantees as GitHub Releases or official distro repos. A compromise of that server or DNS would result in arbitrary binary execution on the user's system. The sha512sums provide some protection against in-transit tampering but not against the host serving a malicious binary from the start. This is a genuine supply-chain concern: an executed binary from a personal/unofficial host. The pattern is common in AUR -bin packages but the risk is real and warrants medium severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: orhun <orhunparmaksiz@gmail.com>
    
      2# https://github.com/orhun/pkgbuilds
    
      3
    
      4pkgname=termimage-bin
    
      5pkgver=1.2.1
    
      6pkgrel=1
    
      7pkgdesc="Display images in your terminal"
    
      8arch=('x86_64')
    
      9url="https://github.com/nabijaczleweli/termimage"
    
      10license=('MIT')
    
      11depends=('gcc-libs')
    
      12conflicts=("${pkgname%-bin}")
    
      13provides=("${pkgname%-bin}")
    
      14source_x86_64=("https://debian.nabijaczleweli.xyz/pool/main/t/${pkgname%-bin}/${pkgname%-bin}_${pkgver}-1_amd64.deb"
    
      15               "${pkgname%-bin}-v$pkgver-LICENSE::$url/raw/v$pkgver/LICENSE")
    
      16sha512sums_x86_64=('ced1024243a8d4ee00e989439ec155d47a2360197dd27d450cb45b16e317c1f0e6325fb7f13f9d8a1a2e06100cb9f06a290f5c0e2b003a3e2e6e7396b1d90324'
    
      17                   '25e0f2eb4d34813f14fabea8245680d734a50ff3be597146c47d4d6c819f61f4f8bb1c6ffa4f9047725aa6923d5db3043b7add60b5f428ab29de6932a70b8a24')
    
      18
    
      19package() {
    
      20  tar -xaf data.tar.xz --directory "${pkgdir}"
    
      21  mv "$pkgdir/usr/share/doc/${pkgname%-bin}" "$pkgdir/usr/share/doc/$pkgname"
    
      22  install -Dm 644 "${pkgname%-bin}-v$pkgver-LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2