{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreicql6geuat3kw2iqw7nv4l4lq3jv6qovi2sgkomm2vcanx2fdaclu",
    "uri": "at://did:plc:yrn4rbgwenb6lfhhzjegbtnc/app.bsky.feed.post/3mp4f3eovi7x2"
  },
  "path": "/t/how-well-are-flathub-packages-moderated/12355#post_3",
  "publishedAt": "2026-06-23T18:33:46.000Z",
  "site": "https://discourse.flathub.org",
  "textContent": "Risks I’ve Seen\n\nChanges Made Upstream\n\nFlathub maintainers don’t have a system in place to monitor and verify changes made upstream. If code released upstream is malicious, it’s impossible to automatically detect it. Ultimately, apart from a tag and commit ID change, no changes are reflected in the Flathub manifest.\n\nThe biggest risk here is that the developer account could be compromised, and malicious code could be injected into the repository and distributed via Flathub. I believe there have been one or two such incidents with Snapcraft.\n\nVulnerabilities Due to Dependencies\n\nDependencies used in applications are also prone to problems. For example, when we update the Python modules that a Python application depends on, we are installing untested new packages. If there is a malicious package on the PyPi side and that version was downloaded during compilation, it’s always possible for it to be transmitted to the end user. This also applies to other package managers. The risk mentioned in the upstream section also applies here.\n\nVulnerabilities stemming from maintainers\n\nNot every application is maintained by verified developers, and some packages are handled by volunteer maintainers like myself. In these cases, any intervention in the application’s resources has the potential to be released without triggering a general warning. However, this risk is relatively low because the number of maintainers with access to multiple repositories is limited, and sending multiple unrelated changes to random repositories would attract attention.\n\nRisky applications\n\nSince this type of malware generally targets crypto applications, VPNs, and password services, considering additional security measures for these types of risky applications might be beneficial.\n\n(Google translate)",
  "title": "How well are flathub packages moderated?"
}