tinydng-cli-bin

maintainer lapsus · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary from dl.tinydng.com (the project's own distribution subdomain, consistent with the official site tinydng.com) and installs it directly as an executable. The sha256sum is pinned, which mitigates tampering at rest, but the host is a small personal/commercial project domain with no established trust chain (no GitHub releases, no distro mirror). The binary is executed directly with no source build option. This is a classic medium-risk pattern: not clearly malicious, but a supply-chain concern because if dl.tinydng.com is compromised or the binary is silently replaced at the same URL, users get arbitrary code execution. The latestver() helper function also fetches and parses the upstream site at build time, though it is not called during the actual build. Overall this matches the standard AUR prebuilt-binary-from-unofficial-host medium risk profile.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:8 curl -s https://tinydng.com | grep -oP 'tinydng-cli-\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-x64\.zip)' | head -1

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("${pkgdisplayname}-${pkgver}-linux-x64.zip::https://dl.tinydng.com/${pkgdisplayname}-${pkgver}-linux-x64.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary from dl.tinydng.com (the project's own distribution subdomain, consistent with the official site tinydng.com) and installs it directly as an executable. The sha256sum is pinned, which mitigates tampering at rest, but the host is a small personal/commercial project domain with no established trust chain (no GitHub releases, no distro mirror). The binary is executed directly with no source build option. This is a classic medium-risk pattern: not clearly malicious, but a supply-chain concern because if dl.tinydng.com is compromised or the binary is silently replaced at the same URL, users get arbitrary code execution. The latestver() helper function also fetches and parses the upstream site at build time, though it is not called during the actual build. Overall this matches the standard AUR prebuilt-binary-from-unofficial-host medium risk profile.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=tinydng-cli-bin
    
      4pkgver=0.1.1
    
      5pkgrel=5
    
      6
    
      7latestver() {
    
      8    curl -s https://tinydng.com | grep -oP 'tinydng-cli-\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-x64\.zip)' | head -1
    
      9}
    
      10
    
      11provides=("tinydng-cli=${pkgver}")
    
      12conflicts=("tinydng-cli")
    
      13replaces=("tinydng-cli<=0.1.0")
    
      14
    
      15url="https://tinydng.com"
    
      16pkgdesc="Compress DNG to save space without losing visual quality"
    
      17license=('unknown')  # No license specified by the developer
    
      18
    
      19arch=('x86_64')
    
      20makedepends=('unzip')
    
      21depends=()
    
      22options=(!debug)
    
      23pkgdisplayname=tinydng-cli
    
      24source=("${pkgdisplayname}-${pkgver}-linux-x64.zip::https://dl.tinydng.com/${pkgdisplayname}-${pkgver}-linux-x64.zip")
    
      25sha256sums=('a3ca1783b91f6529eb047bd5789ffc49a4051b6c2e593a388ac5e83511427bf2')
    
      26
    
      27package() {
    
      28    install -Dm755 "${srcdir}/${pkgdisplayname}" "${pkgdir}/usr/bin/${pkgdisplayname}"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3