winamp2

maintainer HMK · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Windows PE binary (winamp.exe, embedded inside a zip fetched from catbox.moe via an archive.org snapshot) and executes it under Wine. catbox.moe is an anonymous file-hosting service with no accountability — anyone can upload anything there, and the URL could have been replaced before the archive.org snapshot was taken. The sha512sum pins the specific archive.org snapshot, which provides some integrity guarantee for the archived copy, but the original catbox.moe upload is unverifiable and not from any official Nullsoft/AOL/Radionomy distribution channel. Winamp 2.95 is legitimate abandonware, but distributing it via an anonymous paste host rather than an official or well-known mirror is a genuine supply-chain concern: the binary is executed (via Wine) and could contain trojaned code. This is a real medium-severity concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 source=('winamp295rc_full_milkdrop_flac_ape_mpc.zip::https://web.archive.org/web/20240309214220if_/https://litter.catbox.moe/g4jqkt')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt Windows PE binary (winamp.exe, embedded inside a zip fetched from catbox.moe via an archive.org snapshot) and executes it under Wine. catbox.moe is an anonymous file-hosting service with no accountability — anyone can upload anything there, and the URL could have been replaced before the archive.org snapshot was taken. The sha512sum pins the specific archive.org snapshot, which provides some integrity guarantee for the archived copy, but the original catbox.moe upload is unverifiable and not from any official Nullsoft/AOL/Radionomy distribution channel. Winamp 2.95 is legitimate abandonware, but distributing it via an anonymous paste host rather than an official or well-known mirror is a genuine supply-chain concern: the binary is executed (via Wine) and could contain trojaned code. This is a real medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Herbert Knapp
    
      2pkgname=winamp2
    
      3pkgver=2.95
    
      4pkgrel=5
    
      5pkgdesc='Winamp 2.95 audio player with Milkdrop 1.04, FLAC 1.1.2, APE 3.99, MPC 0.99f plugins'
    
      6arch=('any')
    
      7url="http://www.nullsoft.com"
    
      8source=('winamp295rc_full_milkdrop_flac_ape_mpc.zip::https://web.archive.org/web/20240309214220if_/https://litter.catbox.moe/g4jqkt')
    
      9sha512sums=('7dd253b9aa0a6066ffd1332f01ca2620ad2f9951769aaf8fec07264ea7214f2718e8aa9dd780cb20d7d0e996f6a31b025ec66930e4e4ad78de54e4d9bdeec58d')
    
      10license=('unknown')
    
      11depends=('wine')
    
      12makedepends=('imagemagick' 'p7zip')
    
      13
    
      14prepare() {
    
      15  _tmp=$(mktemp -d)
    
      16  cd ${_tmp}
    
      17  7z x "$srcdir/Winamp/winamp.exe"
    
      18  convert .rsrc/ICON/18.ico -thumbnail 32x32 -alpha on -background none -flatten "$srcdir/Winamp/winamp.ico.18.png"
    
      19  rm -r ${_tmp}
    
      20}
    
      21
    
      22package() {
    
      23
    
      24  mkdir -p "$pkgdir/usr/bin" "$pkgdir/usr/share/applications" "$pkgdir/opt"
    
      25  mv "$srcdir/Winamp" "$pkgdir/opt/Winamp2"
    
      26
    
      27  _launcher="$pkgdir/usr/bin/winamp2"
    
      28  {
    
      29    echo '#!/bin/sh'
    
      30    echo 'mkdir -p ~/.winamp2'
    
      31    echo '[[ -d ~/.winamp2/winamp ]] || cp -r /opt/Winamp2 ~/.winamp2/winamp'
    
      32    echo "cd ~/.winamp2/winamp/"
    
      33    echo "WINEDLLOVERRIDES='mscoree,mshtml=' WINEDEBUG=-all WINEPREFIX=~/.winamp2 wine winamp.exe"
    
      34  } > "${_launcher}"
    
      35  chmod +x "${_launcher}"
    
      36  
    
      37  _desktop="${pkgdir}/usr/share/applications/winamp2.desktop"
    
      38  {
    
      39    echo '[Desktop Entry]'
    
      40    echo 'Type=Application'
    
      41    echo "Name=Winamp ${pkgver}"
    
      42    echo "Comment=${pkgdesc}"
    
      43    echo 'Path=/opt/Winamp2'
    
      44    echo 'Exec=/usr/bin/winamp2'
    
      45    echo 'Icon=/opt/Winamp2/winamp.ico.18.png'
    
      46    echo 'Terminal=false'
    
      47    echo 'Categories=AudioVideo;Audio;'
    
      48  } > ${_desktop}
    
      49}
    
      50
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2