tokscale-bin

MEDIUM

maintainer Goldbro233 0 votes scanned 2026-09-28 15:21:17.813621

View on AUR

Why flagged

The package installs a prebuilt binary from npmjs.org, which is not inherently malicious, but the source is a binary release with a skipped upstream verification (no source build), increasing supply-chain risk if the npm package were compromised.

Triggered rules

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs a prebuilt binary from npmjs.org, which is not inherently malicious, but the source is a binary release with a skipped upstream verification (no source build), increasing supply-chain risk if the npm package were compromised.

PKGBUILD

      1# Maintainer: Ricky Morabito <codericcardo@gmail.com>
    
      2
    
      3pkgname=tokscale-bin
    
      4pkgver=4.7.0
    
      5pkgrel=1
    
      6pkgdesc='CLI tool and TUI for tracking token usage and costs from AI coding agents (prebuilt binary)'
    
      7arch=('x86_64')
    
      8url='https://github.com/junhoyeo/tokscale'
    
      9license=('MIT')
    
      10depends=('glibc' 'gcc-libs')
    
      11provides=('tokscale')
    
      12conflicts=('tokscale' 'tokscale-git')
    
      13source=("tokscale-v$pkgver-linux-x64-gnu.tgz::https://registry.npmjs.org/@tokscale/cli-linux-x64-gnu/-/cli-linux-x64-gnu-$pkgver.tgz"
    
      14         "tokscale-LICENSE::https://raw.githubusercontent.com/junhoyeo/tokscale/v$pkgver/LICENSE")
    
      15b2sums=('3bd26054a8f318c59da2ce3b0efe7c86ce82381695f755bb847d1e91cfc97a038c9c4fc4c3828f9c59eb6903a23b4eb1b8667c5d72e2b3da103f16c0013f8490'
    
      16        'b1bda54b1595c875bc2ef3d02acbc5f4371406bd5c21fb56ecef98b2bc8357baf56dd8908e6f1867f4f4bc5c8ceeb7900c01e9f6ca4e44f31721419baba32381')
    
      17
    
      18package() {
    
      19    install -Dm755 "package/bin/tokscale" "$pkgdir/usr/bin/tokscale"
    
      20    install -Dm644 "tokscale-LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      21}
    
      22

Changes since previous scan

--- PKGBUILD @ 2026-07-15 09:48
+++ PKGBUILD @ 2026-09-28 15:21
@@ -1,7 +1,7 @@
 # Maintainer: Ricky Morabito <codericcardo@gmail.com>
 
 pkgname=tokscale-bin
-pkgver=4.5.3
+pkgver=4.7.0
 pkgrel=1
 pkgdesc='CLI tool and TUI for tracking token usage and costs from AI coding agents (prebuilt binary)'
 arch=('x86_64')
@@ -12,7 +12,7 @@
 conflicts=('tokscale' 'tokscale-git')
 source=("tokscale-v$pkgver-linux-x64-gnu.tgz::https://registry.npmjs.org/@tokscale/cli-linux-x64-gnu/-/cli-linux-x64-gnu-$pkgver.tgz"
          "tokscale-LICENSE::https://raw.githubusercontent.com/junhoyeo/tokscale/v$pkgver/LICENSE")
-b2sums=('444ae44d9879d7054726e8eaa16deadeccc184121a3f6d8d5a1d23a43ec031eb05dfdcdfa44f4a32bf0638da2c943be182cfff2134c7cf2edd8a057824433305'
+b2sums=('3bd26054a8f318c59da2ce3b0efe7c86ce82381695f755bb847d1e91cfc97a038c9c4fc4c3828f9c59eb6903a23b4eb1b8667c5d72e2b3da103f16c0013f8490'
         'b1bda54b1595c875bc2ef3d02acbc5f4371406bd5c21fb56ecef98b2bc8357baf56dd8908e6f1867f4f4bc5c8ceeb7900c01e9f6ca4e44f31721419baba32381')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-28 15:21:17	Medium	2
2026-07-23 09:22:54	Clean	0
2026-07-15 09:48:24	Clean	0
2026-07-13 09:41:03	Clean	0
2026-07-11 09:36:41	Clean	0
2026-07-08 09:27:40	Clean	0
2026-07-07 11:24:25	Clean	0
2026-07-03 09:10:52	Clean	0
2026-07-02 10:45:12	Clean	0
2026-07-01 10:41:16	Clean	0
2026-06-30 10:37:17	Clean	0
2026-06-29 12:35:04	Clean	0
2026-06-26 10:25:02	Clean	0
2026-06-25 10:22:06	Clean	0
2026-06-23 10:16:18	Clean	0
2026-06-18 16:11:54	Clean	0