wechat-xwayland

MEDIUM

maintainer duanluan 0 votes scanned 2026-09-08 01:15:25.605207

View on AUR

Why flagged

Downloads and installs an unverifiable script from a personal GitHub repository with SKIP'd checksum, posing a supply-chain risk if the script were malicious.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): Downloads and installs an unverifiable script from a personal GitHub repository with SKIP'd checksum, posing a supply-chain risk if the script were malicious.

PKGBUILD

      1# Maintainer: local package
    
      2pkgname=wechat-xwayland
    
      3pkgver=1.0
    
      4pkgrel=1
    
      5pkgdesc='Launch wechat-bin through Qt XWayland with a KDE activation command'
    
      6arch=('any')
    
      7url='https://aur.archlinux.org/packages/wechat-bin'
    
      8license=('custom')
    
      9depends=('wechat-bin')
    
      10optdepends=('xorg-server-xwayland: run the Qt application through XWayland')
    
      11conflicts=('wechat-bin-xwayland')
    
      12source=('wechat-xwayland'
    
      13        'activate-wechat-xwayland::https://raw.githubusercontent.com/duanluan/shell-scripts/refs/heads/main/activate-wechat.sh'
    
      14        'wechat-xwayland.desktop')
    
      15sha256sums=('SKIP' 'SKIP' 'SKIP')
    
      16
    
      17package() {
    
      18  install -Dm755 "$srcdir/wechat-xwayland" \
    
      19    "$pkgdir/usr/bin/wechat-xwayland"
    
      20  install -Dm755 "$srcdir/activate-wechat-xwayland" \
    
      21    "$pkgdir/usr/bin/activate-wechat-xwayland"
    
      22  install -Dm644 "$srcdir/wechat-xwayland.desktop" \
    
      23    "$pkgdir/usr/share/applications/wechat-xwayland.desktop"
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-08 01:15:25	Medium	2