Benign arch Download

python-winecharm 1.3-1

Python setup.py trojanNetwork API used from setup install or build class

SHA-256c1c08b7d23927e3e44aaaf7f2b3481bb585130693ee22d9832a3988ccc665ff0

URLhttps://aur.archlinux.org/cgit/aur.git/snapshot/python-winecharm.tar.gz

Evidence

Imports subprocess module winecharm.py · lines 3–7

3import gi
4import threading
5import subprocess
6import os
7import shutil

import socket module winecharm.py · lines 12–16

12import yaml
13import sys
14import socket
15import psutil
16import argparse

sys.path mutation (alters module search path) winecharm.py · lines 32–35

32# Import file operation functions directly
33# Add current directory to sys.path for local development
34if os.path.dirname(__file__) not in sys.path:
35    sys.path.insert(0, os.path.dirname(__file__))

System process masquerade names winecharm.py · lines 1801–1810

              if path_env:
                  winedbg_command_with_grep = (
                      f"export PATH={shlex.quote(str(runner_dir))}:$PATH; "
                      f"WINEPREFIX={shlex.quote(str(wineprefix))} winedbg --command 'info proc' | "
                      f"grep -A9 \"{exe_name}\" | grep -v 'grep' | grep '_' | "
                      f"grep -v 'start.exe'    | grep -v 'winedbg.exe' | grep -v 'conhost.exe' | "
                      f"grep -v 'explorer.exe' | grep -v 'services.exe' | grep -v 'rpcss.exe' | "
                      f"grep -v 'svchost.exe'   | grep -v 'plugplay.exe' | grep -v 'winedevice.exe' | "
                      f"cut -f2- -d '_' | tr \"'\" ' '"
                  )

Setup hook runs local Python helper setup.py · lines 9–12

9class build_py(_build_py):
  def run(self):
      self.compile_translations()
      super().run()

No evidence locations were recorded for this file. Raw result