vidplayvst

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt binary installer (.run file) is downloaded from Google Docs (an unofficial, user-controlled host with no stable content guarantee) and executed during the build process. The sha256sum provides integrity for the current file, but Google Docs links can be swapped by the file owner at any time without changing the URL, making the checksum a weak guarantee against future supply-chain substitution. The .run file is executed with --noexec to extract its payload, then a setup.sh script is run after sed modifications — all of this is opaque binary execution from a non-canonical host. This is a genuine medium-severity supply-chain concern: not clearly malicious, but the combination of an executable binary from a personal/unofficial host (Google Drive) with no way to verify upstream authenticity beyond a point-in-time hash is a real risk pattern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("VidPlayVST-$pkgver-Setup.run::https://docs.google.com/uc?id=18_dOOqxYpdYlUIhZDWsYwEJH8QPkDP28&export=download&confirm=t")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): A prebuilt binary installer (.run file) is downloaded from Google Docs (an unofficial, user-controlled host with no stable content guarantee) and executed during the build process. The sha256sum provides integrity for the current file, but Google Docs links can be swapped by the file owner at any time without changing the URL, making the checksum a weak guarantee against future supply-chain substitution. The .run file is executed with --noexec to extract its payload, then a setup.sh script is run after sed modifications — all of this is opaque binary execution from a non-canonical host. This is a genuine medium-severity supply-chain concern: not clearly malicious, but the combination of an executable binary from a personal/unofficial host (Google Drive) with no way to verify upstream authenticity beyond a point-in-time hash is a real risk pattern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: 0chroma <me@chroma.sh>
    
      2pkgname=vidplayvst
    
      3pkgver=2.3.1
    
      4pkgrel=1
    
      5pkgdesc='VidPlayVST is a plug-in for producers composing music synchronised to video.'
    
      6arch=(x86_64)
    
      7url='https://vidplayvst.com/'
    
      8license=('')
    
      9depends=()
    
      10optdepends=()
    
      11provides=(vidplayvst)
    
      12#makedepends=()
    
      13source=("VidPlayVST-$pkgver-Setup.run::https://docs.google.com/uc?id=18_dOOqxYpdYlUIhZDWsYwEJH8QPkDP28&export=download&confirm=t")
    
      14sha256sums=('c7955aed03e442d1222269c1d3444b5ac59b107eab55dcbe1f1427a4241ceb9c')
    
      15
    
      16package() {
    
      17    cd "$srcdir"
    
      18    ls
    
      19    chmod +x "VidPlayVST-$pkgver-Setup.run"
    
      20    command=("./VidPlayVST-$pkgver-Setup.run" --noexec --target .)
    
      21    "${command[@]}"
    
      22    sed -i 's/^sudo //g' setup.sh
    
      23    sed -i "s#\~#/usr/share/vidplayvst#g" setup.sh
    
      24    sed -i "s# \/# ${pkgdir}/#g" setup.sh
    
      25    sh setup.sh
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2