vibe-kanban-bin
LOW
maintainer theorangeguo
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt binary from a project-specific CDN domain (npm-cdn.vibekanban.com) which, while not on a standard code host whitelist, is plausibly owned by the project; the binary is installed as a local application with no evidence of obfuscation, remote code execution, or data exfiltration.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from a project-specific CDN domain (npm-cdn.vibekanban.com) which, while not on a standard code host whitelist, is plausibly owned by the project; the binary is installed as a local application with no evidence of obfuscation, remote code execution, or data exfiltration.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
source_x86_64=(vibe-kanban-bin-0.1.44-x86_64.zip::https://npm-cdn.vibekanban.com/binaries/v0.1.44-20260424091429/linux-x64/vibe-kanban.zip )
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: theorangeguo
2
# Packaging Repo: https://github.com/theorangeguo/aur-packages/tree/main/packages/vibe-kanban-bin
3
pkgname=vibe-kanban-bin
4
pkgver=0.1.44
5
pkgrel=4
6
pkgdesc=AI-powered\ Kanban\ board
7
arch=(x86_64 )
8
url=https://vibekanban.com
9
license=(Proprietary )
10
depends=()
11
makedepends=(unzip )
12
checkdepends=()
13
optdepends=()
14
options=(\!strip )
15
provides=(vibe-kanban )
16
conflicts=(vibe-kanban )
17
validpgpkeys=()
18
install=vibe-kanban-bin.install
19
source=(vibe-kanban.service )
20
sha256sums=('48b6d94e9693f7098ad7d3786ff08b648ce08ab8fcfe8ff13cff97906a12a33f')
21
sha256sums_x86_64=('083f15f027a7052916852f40610db34b021f7e7749593623ac3f67a090447a6b')
22
source_x86_64=(vibe-kanban-bin-0.1.44-x86_64.zip::https://npm-cdn.vibekanban.com/binaries/v0.1.44-20260424091429/linux-x64/vibe-kanban.zip )
23
24
_binary_source_path=vibe-kanban
25
_install_bin_path=/usr/bin/vibe-kanban
26
_wrapper_source_path=''
27
_wrapper_install_path=''
28
_wrapper_mode=755
29
_service_file=vibe-kanban.service
30
_service_install_path=/usr/lib/systemd/user/vibe-kanban.service
31
_doc_files=()
32
_license_files=()
33
_binary_tag=v0.1.44-20260424091429
34
35
package() {
36
_resolve_required_source_file() {
37
local pattern=$1
38
local matches=()
39
local nullglob_was_set=false
40
41
shopt -q nullglob && nullglob_was_set=true
42
shopt -s nullglob
43
matches=("${srcdir}"/$pattern)
44
[ "$nullglob_was_set" = true ] || shopt -u nullglob
45
46
if [ "${#matches[@]}" -ne 1 ]; then
47
printf 'Expected exactly one source match for pattern %s, found %s\n' "$pattern" "${#matches[@]}" >&2
48
return 1
49
fi
50
51
[ -f "${matches[0]}" ] || {
52
printf 'Matched source is not a file: %s\n' "${matches[0]}" >&2
53
return 1
54
}
55
56
printf '%s\n' "${matches[0]}"
57
}
58
59
_install_optional_source_files() {
60
local pattern=$1
61
local target_dir=$2
62
local mode=$3
63
local matches=()
64
local matched_file
65
local nullglob_was_set=false
66
67
shopt -q nullglob && nullglob_was_set=true
68
shopt -s nullglob
69
matches=("${srcdir}"/$pattern)
70
[ "$nullglob_was_set" = true ] || shopt -u nullglob
71
72
for matched_file in "${matches[@]}"; do
73
[ -f "$matched_file" ] || continue
74
install -Dm"$mode" "$matched_file" "${pkgdir}${target_dir}/$(basename "$matched_file")"
75
done
76
}
77
78
local binary_source_file
79
binary_source_file=$(_resolve_required_source_file "${_binary_source_path}")
80
install -Dm755 "$binary_source_file" "${pkgdir}${_install_bin_path}"
81
82
if [ -n "${_wrapper_source_path}" ] && [ -n "${_wrapper_install_path}" ]; then
83
local wrapper_source_file
84
wrapper_source_file=$(_resolve_required_source_file "${_wrapper_source_path}")
85
install -Dm${_wrapper_mode} "$wrapper_source_file" "${pkgdir}${_wrapper_install_path}"
86
fi
87
88
local doc_file
89
for doc_file in "${_doc_files[@]}"; do
90
_install_optional_source_files "$doc_file" "/usr/share/doc/${pkgname}" 644
91
done
92
93
local license_file
94
for license_file in "${_license_files[@]}"; do
95
_install_optional_source_files "$license_file" "/usr/share/licenses/${pkgname}" 644
96
done
97
98
if [ -n "${_service_file}" ] && [ -f "${srcdir}/${_service_file}" ]; then
99
install -Dm644 "${srcdir}/${_service_file}" "${pkgdir}${_service_install_path}"
100
fi
101
}
102
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |