visual-studio-code-autoupdate

MEDIUM

maintainer jjunho 0 votes scanned 2026-10-21 11:33:33.952082

View on AUR

Why flagged

The package installs a 'vscode-update' script (bundled locally, checksummed) that runs twice daily via a systemd user timer to download and install VS Code into /opt/vscode, and the .install hook uses 'runuser' and 'rm -rf /opt/vscode' as root at remove time; the actual update logic is in the bundled 'vscode-update' script which is not visible here, so the realistic risk depends on what that script does — it plausibly fetches and executes a prebuilt binary from Microsoft on a schedule, which is a self-updating mechanism outside pacman's control, but the checksums are present and the source is the maintainer's own GitHub repo, making this a medium-risk auto-updater pattern rather than clearly malicious.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:20 install=visual-studio-code-autoupdate.install

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 65%): The package installs a 'vscode-update' script (bundled locally, checksummed) that runs twice daily via a systemd user timer to download and install VS Code into /opt/vscode, and the .install hook uses 'runuser' and 'rm -rf /opt/vscode' as root at remove time; the actual update logic is in the bundled 'vscode-update' script which is not visible here, so the realistic risk depends on what that script does — it plausibly fetches and executes a prebuilt binary from Microsoft on a schedule, which is a self-updating mechanism outside pacman's control, but the checksums are present and the source is the maintainer's own GitHub repo, making this a medium-risk auto-updater pattern rather than clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Juliano Paiva Junho <jjunho at gmail dot com>
    
      2# SPDX-License-Identifier: 0BSD
    
      3pkgname=visual-studio-code-autoupdate
    
      4pkgver=1.0
    
      5pkgrel=1
    
      6pkgdesc='Direct Microsoft VS Code updater with a twice-daily user timer'
    
      7arch=('x86_64')
    
      8url='https://github.com/jjunho/visual-studio-code-autoupdate'
    
      9license=('0BSD')
    
      10depends=('python>=3.12' 'systemd' 'ca-certificates' 'bash' 'coreutils' 'util-linux'
    
      11         'libxkbfile' 'gnupg' 'gtk3' 'libsecret' 'nss' 'gcc-libs'
    
      12         'libnotify' 'libxss' 'glibc' 'lsof' 'shared-mime-info' 'xdg-utils' 'alsa-lib')
    
      13optdepends=('glib2: move files to trash'
    
      14            'libdbusmenu-glib: KDE global menu'
    
      15            'org.freedesktop.secrets: settings sync'
    
      16            'bubblewrap: agent host sandboxing'
    
      17            'socat: agent host sandboxing')
    
      18provides=('code' 'vscode')
    
      19conflicts=('code' 'visual-studio-code-bin')
    
      20install=visual-studio-code-autoupdate.install
    
      21source=('vscode-update'
    
      22        'code'
    
      23        'vscode-update.service'
    
      24        'vscode-update.timer'
    
      25        'com.microsoft.VSCode.desktop'
    
      26        'com.microsoft.VSCode.UrlHandler.desktop'
    
      27        'code-workspace.xml'
    
      28        'visual-studio-code-autoupdate.install'
    
      29        'README.md'
    
      30        'LICENSE'
    
      31        'test_vscode_update.py')
    
      32sha256sums=('ed0f4ad06e7a67892b73a4e326e4d857347983d17aa83365a9c61d69976bc76f'
    
      33            '6f7887d88eed8a7a36d4127c8c466b4b500d0fc59a10d867f2c69b52353a9d9d'
    
      34            '98b0f14f6e4450b60d93f40856c2cd594778027c67b6cd3f478256df603effeb'
    
      35            'b78b77f72580b2fa0a10e693267c5b0400ce935e3fbb99f8aeb2424d9cc42ec6'
    
      36            'ec91701af331a1631c45d79b7eebe4706fab2119d838845de48c431da1b29da7'
    
      37            '6e1be6dc797966af296216fd08cf16d521786cef059c2f8d0198d3197009c158'
    
      38            'a06f8d3e435e40fe1ae4ac3782edb782ffb51993d73b612ed9cd2054d1a0e57f'
    
      39            'b0b21cf9b72d6017cff9b2b246fc13eef26dbd5aea984ef2fdac37e866fe0575'
    
      40            '33f141c06370f0a4c2fffcc70d97cd98c13c6d75b9eaefc8a16b90ef50ff926e'
    
      41            '6668196519d52d349278e9b272ec3751aeb50d29a688a0eec45b3caae11b7159'
    
      42            '77828472203a1a24c840547d22986e97caa6ace7f57491efe696f9773150aa77')
    
      43
    
      44check() {
    
      45  python -B test_vscode_update.py
    
      46}
    
      47
    
      48package() {
    
      49  install -Dm755 vscode-update "$pkgdir/usr/bin/vscode-update"
    
      50  install -Dm755 code "$pkgdir/usr/bin/code"
    
      51  install -Dm644 vscode-update.service "$pkgdir/usr/lib/systemd/user/vscode-update.service"
    
      52  install -Dm644 vscode-update.timer "$pkgdir/usr/lib/systemd/user/vscode-update.timer"
    
      53  install -Dm644 com.microsoft.VSCode.desktop \
    
      54    "$pkgdir/usr/share/applications/com.microsoft.VSCode.desktop"
    
      55  install -Dm644 com.microsoft.VSCode.UrlHandler.desktop \
    
      56    "$pkgdir/usr/share/applications/com.microsoft.VSCode.UrlHandler.desktop"
    
      57  install -Dm644 code-workspace.xml "$pkgdir/usr/share/mime/packages/code-workspace.xml"
    
      58  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      59  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 11:33:33	Medium	3
2026-10-21 11:31:16	Medium	3