wxmacmolplt

maintainer hseara · 8 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source tarball is fetched from uofi.box.com (University of Illinois Box cloud storage), which is a non-standard, opaque URL (a Box.com shared static link with a hash-like filename rather than a versioned release artifact). While Box.com is a legitimate cloud storage service used by universities, this URL pattern provides no way to verify the file is the official upstream release — the link could be silently replaced by whoever controls that Box account. The sha256sum provides integrity checking for the specific file fetched, which mitigates substitution risk somewhat, but the source is not the official GitHub release tarball (https://github.com/brettbode/wxmacmolplt/releases) that one would expect. The compiled result is executed code installed to /usr. This is a genuine supply-chain concern (unofficial/personal hosting of a compiled source archive) rather than a clear attack, keeping it at MEDIUM severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=(https://uofi.box.com/shared/static/i4ljyf53c1jveymhsg4wuwad4a49fm6f.gz)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source tarball is fetched from uofi.box.com (University of Illinois Box cloud storage), which is a non-standard, opaque URL (a Box.com shared static link with a hash-like filename rather than a versioned release artifact). While Box.com is a legitimate cloud storage service used by universities, this URL pattern provides no way to verify the file is the official upstream release — the link could be silently replaced by whoever controls that Box account. The sha256sum provides integrity checking for the specific file fetched, which mitigates substitution risk somewhat, but the source is not the official GitHub release tarball (https://github.com/brettbode/wxmacmolplt/releases) that one would expect. The compiled result is executed code installed to /usr. This is a genuine supply-chain concern (unofficial/personal hosting of a compiled source archive) rather than a clear attack, keeping it at MEDIUM severity.

PKGBUILD

1 offending line(s) highlighted

      1# Mantainer: Hector Martinez-Seara Monne <hseara ##[at]## gmail?com>
    
      2
    
      3
    
      4pkgname=wxmacmolplt
    
      5pkgver=7.7.3
    
      6pkgrel=1
    
      7pkgdesc="An open-source gui for preparing, submitting and visualizing input and output for the GAMESS quantum chemistry package."
    
      8url="https://brettbode.github.io/wxmacmolplt/"
    
      9license=("GPL2")
    
      10arch=(x86_64)
    
      11depends=('wxwidgets-gtk3' 'glew')
    
      12
    
      13source=(https://uofi.box.com/shared/static/i4ljyf53c1jveymhsg4wuwad4a49fm6f.gz)
    
      14
    
      15sha256sums=('3496ce625819879394357687fce3170649ecc3157efe9a5fac96f9e49bd94f38')
    
      16
    
      17build() {
    
      18  cd "$srcdir/$pkgname-$pkgver"
    
      19  ./configure --prefix=/usr
    
      20  make
    
      21}
    
      22
    
      23package() {
    
      24  cd "$srcdir/$pkgname-$pkgver"
    
      25  make DESTDIR=${pkgdir} install
    
      26}
    
      27
    
      28
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2