360cloud

MEDIUM

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary .deb from down.360safe.com (360's official CDN/download server for their security products), extracts it, and installs the binaries directly. While down.360safe.com is 360's own distribution host (not a random personal host), the concerns are: (1) no HTTPS used for the download, making it susceptible to MITM substitution; (2) a prebuilt closed-source binary is installed without any integrity verification beyond a sha512sum of the .deb — the sha512sum does provide meaningful protection against tampering in transit; (3) 360 is a Chinese security company with a history of privacy concerns. The sha512sum does mitigate the MITM risk to some degree. However, the use of plain HTTP for a binary download is a genuine supply-chain concern even with a checksum (the checksum itself could be stale or the upstream could silently replace the binary). The binary is executed code from a closed-source vendor distributed over HTTP. This warrants medium severity — it's not clearly malicious but represents a real supply-chain risk pattern.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "http://down.360safe.com/360eyun/${pkgname}-$pkgver-deepin-${arch}.deb"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from down.360safe.com (360's official CDN/download server for their security products), extracts it, and installs the binaries directly. While down.360safe.com is 360's own distribution host (not a random personal host), the concerns are: (1) no HTTPS used for the download, making it susceptible to MITM substitution; (2) a prebuilt closed-source binary is installed without any integrity verification beyond a sha512sum of the .deb — the sha512sum does provide meaningful protection against tampering in transit; (3) 360 is a Chinese security company with a history of privacy concerns. The sha512sum does mitigate the MITM risk to some degree. However, the use of plain HTTP for a binary download is a genuine supply-chain concern even with a checksum (the checksum itself could be stale or the upstream could silently replace the binary). The binary is executed code from a closed-source vendor distributed over HTTP. This warrants medium severity — it's not clearly malicious but represents a real supply-chain risk pattern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jack Chen <redchenjs@live.com>
    
      2# Maintainer: taotieren <admin@taotieren.com>
    
      3
    
      4pkgname=360cloud
    
      5pkgver=1.0.0.1010
    
      6pkgrel=6
    
      7pkgdesc="360 Cloud Drive / 360 安全云盘"
    
      8arch=('x86_64')
    
      9url="https://yunpan.360.cn/"
    
      10license=('custom')
    
      11backup=()
    
      12options=('!strip')
    
      13depends=(
    
      14    'curl'
    
      15    'libbsd'
    
      16    'qt5-base'
    
      17    'openssl-1.0'
    
      18)
    
      19source=(
    
      20    "http://down.360safe.com/360eyun/${pkgname}-$pkgver-deepin-${arch}.deb"
    
      21)
    
      22sha512sums=(
    
      23    'deafb66697250a62825b7784b1482eb69a39f61e499c3d67c8f412dc0f6c1fcc78925183ea57f307f7c176cc9a67838fcbe00d81833e6a7e23a0574e95452a1d'
    
      24)
    
      25
    
      26package() {
    
      27    tar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}/"
    
      28
    
      29    ln -sf "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2