I can see from afar that it was not built with dpkg-buildpackage. My bet it
was built with FPM, which would be OK for an artifact for internal use, but is
ridiculous when published (FPM doesn't fill many important fields unless
specifically asked, and programmers usually couldn't be bothered with
providing those by themselves).
Also, keeping code in /var/lib? What?!? Ever heard of LSB?
And just run lintian over the DEB file.