wayshadow-bin

MEDIUM

maintainer justanoobcoder 0 votes scanned 2026-09-01 03:46:42.335607

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release hosted on an untrusted personal account with few votes and recent upload, creating a supply-chain risk if the binary is swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release hosted on an untrusted personal account with few votes and recent upload, creating a supply-chain risk if the binary is swapped.

PKGBUILD

      1# Maintainer: justanoobcoder <syaorancode@gmail.com>
    
      2pkgname=wayshadow-bin
    
      3_pkgname=wayshadow
    
      4pkgver=1.0.0
    
      5pkgrel=1
    
      6pkgdesc="A lightweight, elegant keystroke visualizer for Wayland compositors"
    
      7arch=('x86_64')
    
      8url="https://github.com/justanoobcoder/wayshadow"
    
      9license=('MIT')
    
      10provides=("$_pkgname")
    
      11conflicts=("$_pkgname" "$_pkgname-git")
    
      12depends=(
    
      13    'wayland'
    
      14    'cairo'
    
      15    'pango'
    
      16    'libinput'
    
      17    'libxkbcommon'
    
      18    'gtk3'
    
      19    'libappindicator'
    
      20)
    
      21options=(!debug !strip)
    
      22source=("$url/releases/download/v$pkgver/$_pkgname-$pkgver-$pkgrel-x86_64.pkg.tar.zst")
    
      23sha256sums=('4f95c94dd4bae2c52143ac3ac153ae7129187c996e5ba707116177729b9f2b90')
    
      24
    
      25package() {
    
      26    cd "$srcdir"
    
      27    cp -a usr "$pkgdir/"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-01 03:46:42	Medium	2