Unverified50% confidenceCautionExact time
PKGBUILD中的prepare()、build()和package()函数执行时拥有当前用户完整权限，install脚本以root身份运行，攻击者可借此不受限制地修改系统
1
Sources
50%
Confidence
Long-term
Relevance
8/13/2026
First Seen
Sources
Related Claims
Unverified攻击者可利用npm的postinstall脚本机制在包安装时自动执行任意代码65% similarUnverifiedPKCE（Proof Key for Code Exchange）扩展通过生成随机 code_verifier 并验证其哈希值，可防止 Authorization Code 被劫持后滥用61% similarUnverifiedIf LeakCanary has not yet been introduced into the project, the Profiler can automatically inject the required dependencies into the build file with a single click.61% similarUnverifiedPyCharm's local AI model focuses on code completion tasks and requires no additional configuration — it is ready to use immediately after installing PyCharm.60% similarUnverifiedThe Kuaima client must be run with administrator privileges when first opened to ensure the tool can correctly read and modify Cursor's configuration files58% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/742516API
curl https://kongchang.com/api/v1/knowledge/claims/742516MCP
get_claim(id=742516)