user-foxy-cli

maintainer onefoxyperson · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt/pre-written executable script ('get-foxy') from a personal domain (niko.undo.it) and installs it as a setuid-755 binary at /usr/local/bin/foxy. While a sha256sum is provided (offering some integrity protection against transit tampering), the source is a personal host with no verifiable upstream release infrastructure, no source code to audit, and no signing beyond the checksum. The maintainer controls both the domain and the AUR entry, meaning they could update the remote file and bump the PKGBUILD checksum simultaneously. This is a classic single-point-of-trust supply-chain concern: an executed artifact from an unofficial personal host. The cheaper model's MEDIUM rating is correct here — this is not clearly malicious but represents a genuine supply-chain risk due to the combination of an opaque binary/script, personal hosting, and no independent verification mechanism.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("foxy::https://niko.undo.it/get-foxy")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt/pre-written executable script ('get-foxy') from a personal domain (niko.undo.it) and installs it as a setuid-755 binary at /usr/local/bin/foxy. While a sha256sum is provided (offering some integrity protection against transit tampering), the source is a personal host with no verifiable upstream release infrastructure, no source code to audit, and no signing beyond the checksum. The maintainer controls both the domain and the AUR entry, meaning they could update the remote file and bump the PKGBUILD checksum simultaneously. This is a classic single-point-of-trust supply-chain concern: an executed artifact from an unofficial personal host. The cheaper model's MEDIUM rating is correct here — this is not clearly malicious but represents a genuine supply-chain risk due to the combination of an opaque binary/script, personal hosting, and no independent verification mechanism.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: leo <leo at niko dot undo dot it>
    
      2
    
      3pkgname=user-foxy-cli
    
      4pkgver=1.0.0
    
      5pkgrel=1
    
      6pkgdesc="CLI for the Foxy API — paste sharing, URL shortener, and remote server control"
    
      7arch=('any')
    
      8url="http://niko.undo.it"
    
      9license=('MIT')
    
      10depends=('curl' 'python')
    
      11source=("foxy::https://niko.undo.it/get-foxy")
    
      12sha256sums=('f140b5aa12c95d88b0812f2e3c1d5ba9c4f3df53897585bfa2a77a07c780102f')
    
      13
    
      14package() {
    
      15    install -Dm755 "$srcdir/foxy" "$pkgdir/usr/local/bin/foxy"
    
      16}
    
      17

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2