ultralightwebcursor-git

maintainer LuYishan · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a setuid binary via KAuth helper and performs user-specific configuration changes using sudo, which constitutes a privileged self-installation pattern that could be abused for persistence or privilege escalation.

Triggered rules

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:102 chmod 4755 "${pkgdir}/usr/lib/kf6/kauth/ultralightwebcursor_helper"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a setuid binary via KAuth helper and performs user-specific configuration changes using sudo, which constitutes a privileged self-installation pattern that could be abused for persistence or privilege escalation.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=ultralightwebcursor-git
    
      2_pkgname=Animated_UltralightWeb_Cursor
    
      3pkgver=1.0.1
    
      4pkgrel=1
    
      5pkgdesc="HTML/CSS/JS-based global animated cursor framework integrated with KDE 6 System Settings and KWin Effects"
    
      6arch=('x86_64')
    
      7url="https://github.com/LuYishan-4/Animated_UltralightWeb_Cursor"
    
      8license=('MIT')
    
      9depends=(
    
      10    'qt6-base'
    
      11    'qt6-declarative'
    
      12    'kcmutils'
    
      13    'kcoreaddons'
    
      14    'kconfig'
    
      15    'kconfigwidgets'
    
      16    'ki18n'
    
      17    'kauth'
    
      18    'kwin'
    
      19)
    
      20makedepends=('git' 'cmake' 'extra-cmake-modules' 'p7zip')
    
      21provides=("ultralightwebcursor" "kcm-ultralightwebcursor")
    
      22conflicts=("ultralightwebcursor" "kcm-ultralightwebcursor")
    
      23
    
      24install=ultralightwebcursor.install
    
      25source=("git+https://github.com/LuYishan-4/Animated_UltralightWeb_Cursor")
    
      26sha256sums=('SKIP')
    
      27
    
      28pkgver() {
    
      29    cd "${srcdir}/${_pkgname}"
    
      30    (set -o pipefail; git describe --long --tags --abbrev=7 2>/dev/null | sed 's/\([^-]*-\)g/r\1/;s/-/./g' ||
    
      31    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)")
    
      32}
    
      33
    
      34prepare() {
    
      35    cd "${srcdir}/${_pkgname}"
    
      36
    
      37    # 1. Handle Ultralight SDK archive decompression with strict directory enforcement
    
      38    echo "==> Verifying Ultralight SDK directory alignment..."
    
      39    local sdk_target="sdk/ultralight-free-sdk-1.4.0-linux-x64"
    
      40
    
      41    if [ ! -f "${sdk_target}/include/AppCore/App.h" ]; then
    
      42        echo "==> Target SDK headers not found. Re-extracting cleanly..."
    
      43        rm -rf "${sdk_target}"
    
      44
    
      45        cd sdk
    
      46        7z x ultralight-free-sdk-1.4.0-linux-x64.7z
    
      47        cd ..
    
      48
    
      49        if [ -d "sdk/include" ] && [ -f "sdk/include/AppCore/App.h" ]; then
    
      50            echo "==> SDK extracted flatly into sdk/. Re-structuring into target directory layout..."
    
      51            mkdir -p "${sdk_target}"
    
      52            mv sdk/bin sdk/include sdk/layers "${sdk_target}/" 2>/dev/null || true
    
      53        fi
    
      54
    
      55        if [ -d "${sdk_target}/ultralight-free-sdk-1.4.0-linux-x64" ]; then
    
      56            echo "==> Squashing nested double SDK directories..."
    
      57            mv "${sdk_target}/ultralight-free-sdk-1.4.0-linux-x64" sdk/tmp_sdk
    
      58            rm -rf "${sdk_target}"
    
      59            mv sdk/tmp_sdk "${sdk_target}"
    
      60        fi
    
      61    fi
    
      62
    
      63    if [ ! -f "${sdk_target}/include/AppCore/App.h" ]; then
    
      64        echo "==> ERROR: SDK extraction layout is still invalid."
    
      65        exit 1
    
      66    fi
    
      67    echo "==> Generating compliant policy placeholder in source tree..."
    
      68    cat <<EOF > GUI/org.ultralightwebcursor.policy
    
      69<?xml version="1.0" encoding="utf-8"?>
    
      70<policyconfig>
    
      71</policyconfig>
    
      72EOF
    
      73
    
      74}
    
      75
    
      76build() {
    
      77    cd "${srcdir}/${_pkgname}"
    
      78
    
      79    mkdir -p build/GUI
    
      80    touch build/GUI/org.ultralightwebcursor.policy
    
      81
    
      82    cmake -B build -S . \
    
      83        -DCMAKE_BUILD_TYPE=Release \
    
      84        -DCMAKE_INSTALL_PREFIX=/usr \
    
      85        -DBUILD_TESTING=OFF \
    
      86        -Wno-dev
    
      87
    
      88
    
      89    touch build/GUI/org.ultralightwebcursor.policy
    
      90
    
      91    cmake --build build
    
      92}
    
      93
    
      94package() {
    
      95    cd "${srcdir}/${_pkgname}"
    
      96
    
      97    DESTDIR="${pkgdir}" cmake --install build
    
      98
    
      99    # KAuth Security Compliance:
    
      100    if [ -f "${pkgdir}/usr/lib/kf6/kauth/ultralightwebcursor_helper" ]; then
    
      101        chown root:root "${pkgdir}/usr/lib/kf6/kauth/ultralightwebcursor_helper"
    
      102        chmod 4755 "${pkgdir}/usr/lib/kf6/kauth/ultralightwebcursor_helper"
    
      103    fi
    
      104}
    
      105

Changes since previous scan

--- PKGBUILD @ 2026-07-26 09:32
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,10 +1,10 @@
 pkgname=ultralightwebcursor-git
-_pkgname=UltralightWeb_Cursor
+_pkgname=Animated_UltralightWeb_Cursor
 pkgver=1.0.1
 pkgrel=1
 pkgdesc="HTML/CSS/JS-based global animated cursor framework integrated with KDE 6 System Settings and KWin Effects"
 arch=('x86_64')
-url="https://github.com/LuYishan-4/UltralightWeb_Cursor"
+url="https://github.com/LuYishan-4/Animated_UltralightWeb_Cursor"
 license=('MIT')
 depends=(
     'qt6-base'
@@ -22,7 +22,7 @@
 conflicts=("ultralightwebcursor" "kcm-ultralightwebcursor")
 
 install=ultralightwebcursor.install
-source=("git+https://github.com/LuYishan-4/UltralightWeb_Cursor.git")
+source=("git+https://github.com/LuYishan-4/Animated_UltralightWeb_Cursor")
 sha256sums=('SKIP')
 
 pkgver() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 17:32:42	MEDIUM	3
2026-07-26 15:32:35	MEDIUM	3
2026-07-26 09:32:02	MEDIUM	2
2026-07-26 05:33:58	LOW	3
2026-07-26 05:31:42	MEDIUM	3