vanta-agent

maintainer wim07101993 · 9 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from agent-downloads.vanta.com, which is Vanta's official distribution host (referenced in their own install-linux.sh script at github.com/VantaInc/vanta-agent-scripts). The sha256sum is pinned, which mitigates substitution attacks. However, the artifact is a closed-source, prebuilt binary from a vendor-controlled CDN rather than built from source — if the CDN were compromised or the hash updated to a malicious version, arbitrary code would execute with system privileges (the agent runs as a systemd service). This is a legitimate supply-chain concern: the binary is executed, not just data, and it comes from a non-auditable prebuilt artifact. The risk is real but not currently malicious — this is the standard pattern for proprietary security agents distributed as binaries, and the hash pinning provides meaningful protection. Medium is the correct rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "${pkgver}-${_binname}.deb::https://agent-downloads.vanta.com/targets/versions/${pkgver}/${_binname}-amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from agent-downloads.vanta.com, which is Vanta's official distribution host (referenced in their own install-linux.sh script at github.com/VantaInc/vanta-agent-scripts). The sha256sum is pinned, which mitigates substitution attacks. However, the artifact is a closed-source, prebuilt binary from a vendor-controlled CDN rather than built from source — if the CDN were compromised or the hash updated to a malicious version, arbitrary code would execute with system privileges (the agent runs as a systemd service). This is a legitimate supply-chain concern: the binary is executed, not just data, and it comes from a non-auditable prebuilt artifact. The risk is real but not currently malicious — this is the standard pattern for proprietary security agents distributed as binaries, and the hash pinning provides meaningful protection. Medium is the correct rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: wim07101993
    
      2# Contributor: Michał Lisowski <lisu at riseup dot net>
    
      3# Contributor: Pierre Mavro <pmavro at qovery dot com>
    
      4# Contributor: Mesmer <ldepaulaf at gmail dot com
    
      5#
    
      6# Check for new Linux releases in: https://github.com/VantaInc/vanta-agent-scripts/blob/main/install-linux.sh
    
      7
    
      8_binname=vanta
    
      9_svcname=vanta-agent
    
      10
    
      11pkgname=vanta-agent
    
      12# https://app.vanta.com/downloads
    
      13pkgver=2.16.1
    
      14pkgrel=7
    
      15pkgdesc="Vanta agent"
    
      16arch=('x86_64')
    
      17url="https://www.vanta.com/"
    
      18depends=('systemd')
    
      19license=('custom:vanta')
    
      20install=$pkgname.install
    
      21source=(
    
      22    "${pkgver}-${_binname}.deb::https://agent-downloads.vanta.com/targets/versions/${pkgver}/${_binname}-amd64.deb"
    
      23    "${_svcname}.conf"
    
      24    "vanta-setup.sh"
    
      25)
    
      26sha256sums=('bb8eccb929b63dc7c7137fd35716a69d5e20b616ae200a89ae519c6d2d6cf7f1'
    
      27            '2d650c20f8cabb78d3c629c38d8eed3b15f0e3f9f0b96b68f67fbe5831b41307'
    
      28            '9c93408050135a85d874bc30346ba132a230704de5f0367548128207e923e70d')
    
      29
    
      30package() {
    
      31  echo "  -> Extracting the data.tar.gz..."
    
      32  tar -xzf data.tar.gz -C .
    
      33
    
      34  echo "  -> Moving stuff in place..."
    
      35  install -Dm644 "$srcdir"/usr/lib/systemd/system/vanta.service "$pkgdir"/usr/lib/systemd/system/$_svcname.service
    
      36  # systemd override for regular restart because of Agent instability
    
      37  install -Dm644 $_svcname.conf "$pkgdir"/etc/systemd/system/$_svcname.service.d/$_svcname.conf
    
      38  # changelog
    
      39  install -Dm644 usr/share/doc/vanta/changelog.gz "$pkgdir"/usr/share/doc/$_binname/changelog.gz
    
      40  # custom install script to create the conf file
    
      41  install -Dm755 "$srcdir/vanta-setup.sh" "$pkgdir/usr/bin/vanta-setup"
    
      42  # vanta
    
      43  for i in var/vanta/* ; do
    
      44    install -Dm755 $i "$pkgdir"/$i
    
      45  done
    
      46
    
      47  # Create a symlink to vanta-cli in /usr/bin for easy access
    
      48  mkdir -p "$pkgdir/usr/bin"
    
      49  ln -s /var/vanta/vanta-cli "$pkgdir/usr/bin/vanta-cli"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2