xctu

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:15 source_i686=("http://ftp1.digi.com/support/utilities/40002880_AJ.run")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt .run installer binaries from ftp1.digi.com (Digi International's official FTP server) and executes them during prepare(). ftp1.digi.com is the legitimate vendor distribution host for Digi International (makers of XBee modules), so this is not an unofficial or personal host — it is the actual upstream vendor. However, the binaries are downloaded over plain HTTP (not HTTPS), meaning there is no transport-layer integrity protection, and the checksums are MD5 (weak but present). The executed .run installer is a prebuilt binary blob whose contents cannot be audited from the PKGBUILD alone. This pattern — executing a vendor-supplied binary installer to extract files — is common for proprietary software in the AUR (similar to many other packages like teamviewer, zoom, etc.) and is not inherently malicious. The risk is real but typical for this class of package: if the vendor host were compromised or the HTTP connection MITMed, arbitrary code would execute. This is a genuine medium-severity supply-chain concern (executed binary from a vendor host over plain HTTP with weak checksums) but not a high-severity attack.