vpuppr-bin

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD has two real concerns: (1) During package() it runs 'pip3 install opencv-python' without any version pin or hash verification, installing an unpinned PyPI package into the system Python environment at build/install time. This is a genuine supply-chain risk — a compromised or typosquatted opencv-python release on PyPI would execute arbitrary code. (2) It also fetches an icon via curl from GitHub at package() time without any integrity check, though this is lower risk as it is just image data. The pip install is the primary concern: it bypasses pacman's dependency tracking, installs into the live system (not pkgdir), and is unpinned. The upstream binary itself is from the official GitHub releases page with a sha256sum, which is fine. Overall this is a real medium-severity supply-chain concern, not a false positive, though not an active attack.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:53 pip3 install opencv-python 2> /dev/null

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD has two real concerns: (1) During package() it runs 'pip3 install opencv-python' without any version pin or hash verification, installing an unpinned PyPI package into the system Python environment at build/install time. This is a genuine supply-chain risk — a compromised or typosquatted opencv-python release on PyPI would execute arbitrary code. (2) It also fetches an icon via curl from GitHub at package() time without any integrity check, though this is lower risk as it is just image data. The pip install is the primary concern: it bypasses pacman's dependency tracking, installs into the live system (not pkgdir), and is unpinned. The upstream binary itself is from the official GitHub releases page with a sha256sum, which is fine. Overall this is a real medium-severity supply-chain concern, not a false positive, though not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ByteDream
    
      2pkgname=vpuppr-bin
    
      3pkgdesc="VTuber application made with Godot 3.5"
    
      4arch=('x86_64')
    
      5url="https://github.com/virtual-puppet-project/vpuppr"
    
      6license=('MIT')
    
      7
    
      8pkgver=0.9.0
    
      9pkgrel=3
    
      10
    
      11replaces=(
    
      12  'openseeface-gd'
    
      13  'puppeteer'
    
      14)
    
      15
    
      16depends=(
    
      17  'python'
    
      18  'python-pip'
    
      19)
    
      20
    
      21source=("${pkgname}-${pkgver}.zip::https://github.com/virtual-puppet-project/vpuppr/releases/download/${pkgver}/vpuppr_${pkgver}_linux.zip")
    
      22sha256sums=('95c436e55a68e4abeb967acfa0ec9717dd6e0472ee72c346ded5aeb4a65ef587')
    
      23
    
      24pre_install() {
    
      25  for v in "" "3" "3.10" "3.9" "3.8" "3.7"; do
    
      26    if "python$v" --version 2> /dev/null | grep -E -q "3.([7-9]|10)\."; then
    
      27      return
    
      28    fi
    
      29  done
    
      30
    
      31  echo "No valid python version detected. Please install any python version from 3.7 - 3.10 to run VPupPr correctly." >&2
    
      32  exit 1
    
      33}
    
      34
    
      35package() {
    
      36  mkdir -p $pkgdir/usr/{share/vpuppr,share/applications,bin}
    
      37  cp -rf ./flatpak/* $pkgdir/usr/share/vpuppr
    
      38  chmod 755 -R $pkgdir/usr/share/vpuppr/*
    
      39  ln -sf ../share/vpuppr/vpuppr.x86_64 $pkgdir/usr/bin/vpuppr
    
      40
    
      41  curl -L https://github.com/virtual-puppet-project/vpuppr/raw/0.9.0/assets/osfgd_icon.png -o "$pkgdir/usr/share/vpuppr/vpuppr_icon.png"
    
      42  cat > "$pkgdir/usr/share/applications/vpuppr.desktop"<< EOF
    
      43[Desktop Entry]
    
      44Name=VPupPr
    
      45Exec=/usr/share/vpuppr/vpuppr.x86_64
    
      46Icon=/usr/share/vpuppr/vpuppr_icon.png
    
      47Type=Application
    
      48Categories=Graphics;AudioVideo;Recoder;
    
      49Terminal=False
    
      50EOF
    
      51
    
      52  # the bundled opencv doesn't work in some cases. installing the newest version via pip and symlinking the opencv directory fixes this issues
    
      53  pip3 install opencv-python 2> /dev/null
    
      54  rm -r $pkgdir/usr/share/vpuppr/resources/extensions/openseeface-tracker/OpenSeeFace/cv2
    
      55  ln -s $(python3 -c 'import site; print(site.getsitepackages()[0])')/cv2 $pkgdir/usr/share/vpuppr/resources/extensions/openseeface-tracker/OpenSeeFace/cv2
    
      56}
    
      57
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2