twg-cli-bin

MEDIUM

maintainer boiko 1 votes scanned 2026-08-28 01:33:41.799663

View on AUR

Why flagged

Downloads and installs a prebuilt binary from 'teamwork-graph.atlassian.com', which appears to be Atlassian's own infrastructure but is a non-standard subdomain not on any whitelist; checksums are provided so integrity is verifiable, but the binary is executed directly without any build step, making it a medium-risk prebuilt install from a plausibly official but unverifiable vendor host.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_x86_64=("twg-linux-x64-v${pkgver}::https://teamwork-graph.atlassian.com/cli/twg-linux-x64-v${pkgver}")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and installs a prebuilt binary from 'teamwork-graph.atlassian.com', which appears to be Atlassian's own infrastructure but is a non-standard subdomain not on any whitelist; checksums are provided so integrity is verifiable, but the binary is executed directly without any build step, making it a medium-risk prebuilt install from a plausibly official but unverifiable vendor host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mike Boiko <mike@boiko.ca>
    
      2
    
      3pkgname=twg-cli-bin
    
      4pkgver=1.2.6
    
      5pkgrel=1
    
      6pkgdesc='Atlassian Teamwork Graph CLI (prebuilt binary)'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://developer.atlassian.com/cloud/twg-cli/'
    
      9license=('Apache-2.0')
    
      10depends=('glibc')
    
      11provides=('twg-cli')
    
      12conflicts=('twg' 'twg-cli')
    
      13options=('!strip' '!debug')
    
      14
    
      15source=("twg-cli-LICENSE::https://raw.githubusercontent.com/atlassian/twg-cli/main/LICENSE")
    
      16source_x86_64=("twg-linux-x64-v${pkgver}::https://teamwork-graph.atlassian.com/cli/twg-linux-x64-v${pkgver}")
    
      17source_aarch64=("twg-linux-arm64-v${pkgver}::https://teamwork-graph.atlassian.com/cli/twg-linux-arm64-v${pkgver}")
    
      18
    
      19sha256sums=('007879788b4d4a258cf924e4177a9f4f808b4aec5c2fd6ac65c09b526c07177f')
    
      20sha256sums_x86_64=('7973e5ff376a46597e9214295053e507d2e7a1b3b4d5c1a083f3a78453e6c750')
    
      21sha256sums_aarch64=('55f4442992a790dd3c2571fcf01dcab74b00c16c23a0c5b1cf654a84eed04eea')
    
      22
    
      23package() {
    
      24	local binary
    
      25
    
      26	if [[ "$CARCH" == x86_64 ]]; then
    
      27		binary="twg-linux-x64-v${pkgver}"
    
      28	else
    
      29		binary="twg-linux-arm64-v${pkgver}"
    
      30	fi
    
      31
    
      32	install -Dm755 "$srcdir/$binary" "$pkgdir/usr/bin/twg"
    
      33	install -Dm644 "$srcdir/twg-cli-LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-28 01:33:41	Medium	3
2026-08-28 00:07:31	Medium	3
2026-08-27 23:34:53	Medium	3
2026-08-27 23:33:31	Medium	2