ucpd-monitor

MEDIUM

maintainer kumen 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt AppImage from GitHub Releases, which is an unverifiable executable binary; if the source were swapped, it could lead to arbitrary code execution during extraction or runtime.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from GitHub Releases, which is an unverifiable executable binary; if the source were swapped, it could lead to arbitrary code execution during extraction or runtime.

PKGBUILD

      1# Maintainer: kumen
    
      2pkgname="ucpd-monitor"
    
      3pkgver=3.2.7
    
      4pkgrel=1
    
      5pkgdesc="A cross-platform Electron desktop application for real-time monitoring and analysis of USB Power Delivery (PD) communication captured by STM32 UCPD hardware."
    
      6arch=("x86_64")
    
      7depends=('alsa-lib' 'gtk3' 'nss')
    
      8conflicts=()
    
      9url="https://github.com/aso/UCPD-Monitor/tree/main"
    
      10license=('MIT')
    
      11options=(!strip)
    
      12
    
      13_file_name="UCPD-Monitor-${pkgver}.AppImage"
    
      14
    
      15source=("https://github.com/aso/UCPD-Monitor/releases/download/v${pkgver}/${_file_name}"
    
      16	"ucpd-monitor.desktop")
    
      17sha256sums=('c14cd44421ab57b20ab8cd01e48c1167a5145a51ac60b45c3ac3831d99ab40d1'
    
      18	    '70fa7e53f9aba409e044f3a3afd03f37b63e9bb9633093c7312de3564984f184')
    
      19
    
      20prepare(){
    
      21	# mark as executable
    
      22	chmod +x "${srcdir}/${_file_name}"
    
      23
    
      24	# extract
    
      25	${srcdir}/${_file_name} --appimage-extract
    
      26}
    
      27
    
      28package() {
    
      29	# install the main files.
    
      30        msg2 'Installing application'
    
      31	install -d -m755 "${pkgdir}/opt/${pkgname}"
    
      32	cp -Rr "${srcdir}/squashfs-root/"* "${pkgdir}/opt/${pkgname}"
    
      33
    
      34        msg2 'Installing desktop shortcuts'
    
      35	install -d -m755 "${pkgdir}/usr/share/applications/"
    
      36	install -Dm 644  "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      37	
    
      38	# move icon files to /usr
    
      39        msg2 'Installing icons'
    
      40	install -d -m755 "${pkgdir}/usr/share/pixmaps//"
    
      41        install -Dm 644  "${srcdir}/squashfs-root/usb-pd-monitor.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      42	
    
      43	# fix file permissions - all directories as 755
    
      44	find "${pkgdir}/"{opt,usr} -type d -exec chmod 755 {} \;
    
      45	
    
      46	mv "${pkgdir}/opt/${pkgname}/usb-pd-monitor" "${pkgdir}/opt/${pkgname}/${pkgname}"
    
      47	chmod +x "${pkgdir}/opt/${pkgname}/${pkgname}"
    
      48	install -d -m755 "${pkgdir}/usr/bin"
    
      49	ln -sr "${pkgdir}/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      50}
    
      51
    
      52#
    
      53# makepkg --printsrcinfo > .SRCINFO
    
      54#
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 00:18:51	Medium	2
2026-10-11 00:26:05	Medium	2
2026-10-10 00:11:52	Medium	2
2026-10-09 10:10:57	Medium	2