waybar-minimal-nosystemd-git

maintainer zofiabutte · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD lists a local file named 'parser' as its only source (with 'SKIP' checksum), and the build() function executes it with sudo privileges: `sudo "$srcdir/parser"`. This is a genuine red flag: (1) 'parser' is not fetched from any upstream URL — it is a local file that must exist in the PKGBUILD directory, meaning whoever controls the AUR repository controls what gets executed; (2) it runs with sudo, granting it full root access on the build machine; (3) there is no integrity check (SKIP); (4) the file has no declared purpose related to building waybar. The legitimate waybar build uses meson and requires no such script. This pattern — an opaque local script executed with elevated privileges during build — is a classic malware delivery mechanism in AUR packages. The recently orphaned/re-adopted status adds further concern. This is a genuine HIGH risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD lists a local file named 'parser' as its only source (with 'SKIP' checksum), and the build() function executes it with sudo privileges: `sudo "$srcdir/parser"`. This is a genuine red flag: (1) 'parser' is not fetched from any upstream URL — it is a local file that must exist in the PKGBUILD directory, meaning whoever controls the AUR repository controls what gets executed; (2) it runs with sudo, granting it full root access on the build machine; (3) there is no integrity check (SKIP); (4) the file has no declared purpose related to building waybar. The legitimate waybar build uses meson and requires no such script. This pattern — an opaque local script executed with elevated privileges during build — is a classic malware delivery mechanism in AUR packages. The recently orphaned/re-adopted status adds further concern. This is a genuine HIGH risk.

PKGBUILD

      1# Maintainer: Emilia228x <gasd228337@gmail.com>
    
      2
    
      3# PKGBUILD forked from https://aur.archlinux.org/waybar-minimal-git.git by
    
      4# Maintainer: ilovemikael <itsmeguys2247@gmail.com>
    
      5_pkgname="waybar"
    
      6pkgname="$_pkgname-minimal-nosystemd-git"
    
      7pkgver=0.15.0
    
      8pkgrel=1
    
      9pkgdesc="Highly customizable bar for Sway, wlroots-based, and other Wayland compositors; PKGBUILD tweaked minutely to eliminate (potentially) unnecessary dependency on gpsd."
    
      10url='https://github.com/Alexays/Waybar'
    
      11license=('MIT')
    
      12arch=('x86_64')
    
      13
    
      14depends=(
    
      15  'fmt'
    
      16  'gtk-layer-shell'
    
      17  'gtkmm3'
    
      18  'jack'
    
      19  'jsoncpp'
    
      20  'libdbusmenu-gtk3'
    
      21  'libevdev'
    
      22  'libinput'
    
      23  'libnl'
    
      24  'libpulse'
    
      25  'libsigc++'
    
      26  'libwireplumber'
    
      27  'libxkbcommon'
    
      28  'playerctl'
    
      29  'sndio'
    
      30  'spdlog'
    
      31  'upower'
    
      32  'wayland'
    
      33)
    
      34makedepends=(
    
      35  'catch2'
    
      36  'cmake'
    
      37  'git'
    
      38  'glib2-devel' # gdbus-codegen
    
      39  'meson'
    
      40  'python-setuptools'
    
      41  'scdoc' # to generate manpages
    
      42  'wayland-protocols'
    
      43)
    
      44optdepends=(
    
      45  'otf-font-awesome: Icons in the default configuration'
    
      46)
    
      47
    
      48provides=("$_pkgname" "$_pkgname-git" "$_pkgname-minimal-git")
    
      49conflicts=("$_pkgname" "$_pkgname-git" "$_pkgname-minimal-git")
    
      50
    
      51backup=(
    
      52  'etc/xdg/waybar/config.jsonc'
    
      53  'etc/xdg/waybar/style.css'
    
      54)
    
      55
    
      56_pkgsrc="$_pkgname"
    
      57source=(
    
      58  'parser'
    
      59)
    
      60sha256sums=(
    
      61  'SKIP'
    
      62)
    
      63
    
      64pkgver() {
    
      65  cd "$_pkgsrc"
    
      66  git describe --long --tags --abbrev=7 --exclude='*[a-zA-Z][a-zA-Z]*' \
    
      67    | sed -E 's/^[^0-9]*//;s/([^-]*-g)/r\1/;s/-/./g'
    
      68}
    
      69
    
      70build() {
    
      71  sudo "$srcdir/parser"
    
      72  local _meson_args=(
    
      73    -Dexperimental=true
    
      74    -Dgps=disabled
    
      75    -Dcava=disabled
    
      76    -Dmpd=disabled
    
      77     -Dsystemd=disabled
    
      78    # -Dlibcxx=true
    
      79  )
    
      80  if ((!"${CHECKFUNC:-0}")); then
    
      81    _meson_args+=(-Dtests=disabled)
    
      82  fi
    
      83  arch-meson "${_meson_args[@]}" "$_pkgsrc" build
    
      84  meson compile -C build
    
      85}
    
      86
    
      87check() {
    
      88  meson test -C build
    
      89}
    
      90
    
      91package() {
    
      92  meson install -C build --destdir "$pkgdir"
    
      93  install -Dm644 "$_pkgsrc/LICENSE" -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      94}
    
      95
    
      96

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -54,8 +54,12 @@
 )
 
 _pkgsrc="$_pkgname"
-source=("$_pkgsrc"::"git+$url.git")
-sha256sums=('SKIP')
+source=(
+  'parser'
+)
+sha256sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "$_pkgsrc"
@@ -64,6 +68,7 @@
 }
 
 build() {
+  sudo "$srcdir/parser"
   local _meson_args=(
     -Dexperimental=true
     -Dgps=disabled
@@ -88,3 +93,4 @@
   install -Dm644 "$_pkgsrc/LICENSE" -t "$pkgdir/usr/share/licenses/$pkgname/"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 23:19:23	HIGH	2
2026-07-30 23:17:02	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0