360cloud

MEDIUM

maintainer orphaned 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary .deb from down.360safe.com (360's official CDN/download server for their security products), extracts it, and installs the binaries directly. While down.360safe.com is 360's own distribution host (not a random personal host), the concerns are: (1) no HTTPS used for the download, making it susceptible to MITM substitution; (2) a prebuilt closed-source binary is installed without any integrity verification beyond a sha512sum of the .deb — the sha512sum does provide meaningful protection against tampering in transit; (3) 360 is a Chinese security company with a history of privacy concerns. The sha512sum does mitigate the MITM risk to some degree. However, the use of plain HTTP for a binary download is a genuine supply-chain concern even with a checksum (the checksum itself could be stale or the upstream could silently replace the binary). The binary is executed code from a closed-source vendor distributed over HTTP. This warrants medium severity — it's not clearly malicious but represents a real supply-chain risk pattern.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "http://down.360safe.com/360eyun/${pkgname}-$pkgver-deepin-${arch}.deb"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from down.360safe.com (360's official CDN/download server for their security products), extracts it, and installs the binaries directly. While down.360safe.com is 360's own distribution host (not a random personal host), the concerns are: (1) no HTTPS used for the download, making it susceptible to MITM substitution; (2) a prebuilt closed-source binary is installed without any integrity verification beyond a sha512sum of the .deb — the sha512sum does provide meaningful protection against tampering in transit; (3) 360 is a Chinese security company with a history of privacy concerns. The sha512sum does mitigate the MITM risk to some degree. However, the use of plain HTTP for a binary download is a genuine supply-chain concern even with a checksum (the checksum itself could be stale or the upstream could silently replace the binary). The binary is executed code from a closed-source vendor distributed over HTTP. This warrants medium severity — it's not clearly malicious but represents a real supply-chain risk pattern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jack Chen <redchenjs@live.com>
    
      2# Maintainer: taotieren <admin@taotieren.com>
    
      3
    
      4pkgname=360cloud
    
      5pkgver=1.0.0.1010
    
      6pkgrel=6
    
      7pkgdesc="360 Cloud Drive / 360 安全云盘"
    
      8arch=('x86_64')
    
      9url="https://yunpan.360.cn/"
    
      10license=('custom')
    
      11backup=()
    
      12options=('!strip')
    
      13depends=(
    
      14    'curl'
    
      15    'libbsd'
    
      16    'qt5-base'
    
      17    'openssl-1.0'
    
      18)
    
      19source=(
    
      20    "http://down.360safe.com/360eyun/${pkgname}-$pkgver-deepin-${arch}.deb"
    
      21)
    
      22sha512sums=(
    
      23    'deafb66697250a62825b7784b1482eb69a39f61e499c3d67c8f412dc0f6c1fcc78925183ea57f307f7c176cc9a67838fcbe00d81833e6a7e23a0574e95452a1d'
    
      24)
    
      25
    
      26package() {
    
      27    tar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}/"
    
      28
    
      29    ln -sf "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2