xchat-se

maintainer orphaned · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 .deb binary from xchat.servx.org, which is the project's own (unofficial/personal) hosting site rather than a major distribution mirror or well-known upstream. The binary is extracted and installed directly onto the system (bsdtar unpacks data.tar.xz from the .deb, placing executables and libraries into the package root). This is a classic supply-chain risk: if xchat.servx.org is compromised or the maintainer's hosting is taken over, arbitrary code could be executed on users' systems. The MD5 checksum provides only weak integrity assurance. While the site appears to be the project's own distribution channel (the url= field matches the source host), it is not an official distribution infrastructure, and the package installs a prebuilt binary blob rather than building from source. This warrants a MEDIUM rating — a real supply-chain concern, not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=('https://xchat.servx.org/linux/x86_64/linuxmint/stable/18/xchat-se_1.2.21-1_amd64.deb'

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt x86_64 .deb binary from xchat.servx.org, which is the project's own (unofficial/personal) hosting site rather than a major distribution mirror or well-known upstream. The binary is extracted and installed directly onto the system (bsdtar unpacks data.tar.xz from the .deb, placing executables and libraries into the package root). This is a classic supply-chain risk: if xchat.servx.org is compromised or the maintainer's hosting is taken over, arbitrary code could be executed on users' systems. The MD5 checksum provides only weak integrity assurance. While the site appears to be the project's own distribution channel (the url= field matches the source host), it is not an official distribution infrastructure, and the package installs a prebuilt binary blob rather than building from source. This warrants a MEDIUM rating — a real supply-chain concern, not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Markus Kitsinger (SwooshyCueb) <root@swooshalicio.us>
    
      2
    
      3pkgname=xchat-se
    
      4pkgver=1.2.21
    
      5pkgrel=4
    
      6pkgdesc="An xchat fork with a few different features"
    
      7arch=('x86_64')
    
      8url="https://xchat.servx.org/"
    
      9options=('!strip')
    
      10provides=("xchat")
    
      11conflicts=('xchat')
    
      12source=('https://xchat.servx.org/linux/x86_64/linuxmint/stable/18/xchat-se_1.2.21-1_amd64.deb'
    
      13        'xchat-se.install')
    
      14md5sums=('16ef377b9e708a89968edf80f35c52ea'
    
      15         '8de528b549f6fffa56fb492162faed63')
    
      16
    
      17depends=('gtk2'
    
      18         'openssl-1.0'
    
      19         'dbus-glib'
    
      20         'libnotify')
    
      21optdepends=('enchant: for spell checking support'
    
      22            'perl: for perl plugin'
    
      23            'tcl: for tcl plugin'
    
      24            'python2: for python plugin')
    
      25
    
      26package() {
    
      27  cd "${pkgdir}"
    
      28
    
      29  bsdtar xf "${srcdir}/data.tar.xz"
    
      30
    
      31  # Move pkgconfig to proper location
    
      32  mv "usr/lib/x86_64-linux-gnu/pkgconfig" "usr/lib/pkgconfig"
    
      33  # We leave the xchat/plugins folder where it is
    
      34  # because the path is hard-coded in the xchat binary
    
      35
    
      36  # Remove extra keywords line from desktop file
    
      37  # We probably don't need this any more but I'm gonna leave it here anyway ~MK
    
      38  sed -i '0,/^Keywords=.\+/! {/^Keywords=.\+/d}' "usr/share/applications/xchat.desktop"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 23:12:22	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2