ultralightwebcursor-git

MEDIUM

maintainer LuYishan 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs a setuid binary via KAuth helper and performs user-specific configuration changes using sudo, which constitutes a privileged self-installation pattern that could be abused for persistence or privilege escalation.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:102 chmod 4755 "${pkgdir}/usr/lib/kf6/kauth/ultralightwebcursor_helper"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a setuid binary via KAuth helper and performs user-specific configuration changes using sudo, which constitutes a privileged self-installation pattern that could be abused for persistence or privilege escalation.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=ultralightwebcursor-git
    
      2_pkgname=Animated_UltralightWeb_Cursor
    
      3pkgver=1.0.1
    
      4pkgrel=1
    
      5pkgdesc="HTML/CSS/JS-based global animated cursor framework integrated with KDE 6 System Settings and KWin Effects"
    
      6arch=('x86_64')
    
      7url="https://github.com/LuYishan-4/Animated_UltralightWeb_Cursor"
    
      8license=('MIT')
    
      9depends=(
    
      10    'qt6-base'
    
      11    'qt6-declarative'
    
      12    'kcmutils'
    
      13    'kcoreaddons'
    
      14    'kconfig'
    
      15    'kconfigwidgets'
    
      16    'ki18n'
    
      17    'kauth'
    
      18    'kwin'
    
      19)
    
      20makedepends=('git' 'cmake' 'extra-cmake-modules' 'p7zip')
    
      21provides=("ultralightwebcursor" "kcm-ultralightwebcursor")
    
      22conflicts=("ultralightwebcursor" "kcm-ultralightwebcursor")
    
      23
    
      24install=ultralightwebcursor.install
    
      25source=("git+https://github.com/LuYishan-4/Animated_UltralightWeb_Cursor")
    
      26sha256sums=('SKIP')
    
      27
    
      28pkgver() {
    
      29    cd "${srcdir}/${_pkgname}"
    
      30    (set -o pipefail; git describe --long --tags --abbrev=7 2>/dev/null | sed 's/\([^-]*-\)g/r\1/;s/-/./g' ||
    
      31    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)")
    
      32}
    
      33
    
      34prepare() {
    
      35    cd "${srcdir}/${_pkgname}"
    
      36
    
      37    # 1. Handle Ultralight SDK archive decompression with strict directory enforcement
    
      38    echo "==> Verifying Ultralight SDK directory alignment..."
    
      39    local sdk_target="sdk/ultralight-free-sdk-1.4.0-linux-x64"
    
      40
    
      41    if [ ! -f "${sdk_target}/include/AppCore/App.h" ]; then
    
      42        echo "==> Target SDK headers not found. Re-extracting cleanly..."
    
      43        rm -rf "${sdk_target}"
    
      44
    
      45        cd sdk
    
      46        7z x ultralight-free-sdk-1.4.0-linux-x64.7z
    
      47        cd ..
    
      48
    
      49        if [ -d "sdk/include" ] && [ -f "sdk/include/AppCore/App.h" ]; then
    
      50            echo "==> SDK extracted flatly into sdk/. Re-structuring into target directory layout..."
    
      51            mkdir -p "${sdk_target}"
    
      52            mv sdk/bin sdk/include sdk/layers "${sdk_target}/" 2>/dev/null || true
    
      53        fi
    
      54
    
      55        if [ -d "${sdk_target}/ultralight-free-sdk-1.4.0-linux-x64" ]; then
    
      56            echo "==> Squashing nested double SDK directories..."
    
      57            mv "${sdk_target}/ultralight-free-sdk-1.4.0-linux-x64" sdk/tmp_sdk
    
      58            rm -rf "${sdk_target}"
    
      59            mv sdk/tmp_sdk "${sdk_target}"
    
      60        fi
    
      61    fi
    
      62
    
      63    if [ ! -f "${sdk_target}/include/AppCore/App.h" ]; then
    
      64        echo "==> ERROR: SDK extraction layout is still invalid."
    
      65        exit 1
    
      66    fi
    
      67    echo "==> Generating compliant policy placeholder in source tree..."
    
      68    cat <<EOF > GUI/org.ultralightwebcursor.policy
    
      69<?xml version="1.0" encoding="utf-8"?>
    
      70<policyconfig>
    
      71</policyconfig>
    
      72EOF
    
      73
    
      74}
    
      75
    
      76build() {
    
      77    cd "${srcdir}/${_pkgname}"
    
      78
    
      79    mkdir -p build/GUI
    
      80    touch build/GUI/org.ultralightwebcursor.policy
    
      81
    
      82    cmake -B build -S . \
    
      83        -DCMAKE_BUILD_TYPE=Release \
    
      84        -DCMAKE_INSTALL_PREFIX=/usr \
    
      85        -DBUILD_TESTING=OFF \
    
      86        -Wno-dev
    
      87
    
      88
    
      89    touch build/GUI/org.ultralightwebcursor.policy
    
      90
    
      91    cmake --build build
    
      92}
    
      93
    
      94package() {
    
      95    cd "${srcdir}/${_pkgname}"
    
      96
    
      97    DESTDIR="${pkgdir}" cmake --install build
    
      98
    
      99    # KAuth Security Compliance:
    
      100    if [ -f "${pkgdir}/usr/lib/kf6/kauth/ultralightwebcursor_helper" ]; then
    
      101        chown root:root "${pkgdir}/usr/lib/kf6/kauth/ultralightwebcursor_helper"
    
      102        chmod 4755 "${pkgdir}/usr/lib/kf6/kauth/ultralightwebcursor_helper"
    
      103    fi
    
      104}
    
      105

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2