adrive

maintainer orphaned · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .exe from the official vendor's CDN, extracts an app.asar file, and runs it via system Electron; while the source host is non-standard and the checksum is verifiable, the worst case of a malicious swap is limited to code execution within the app context, but it is not actively obfuscated or exfiltrating, and the source is plausibly official.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .exe from the official vendor's CDN, extracts an app.asar file, and runs it via system Electron; while the source host is non-standard and the checksum is verifiable, the worst case of a malicious swap is limited to code execution within the app context, but it is not actively obfuscated or exfiltrating, and the source is plausibly official.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://cdn.aliyundrive.net/downloads/apps/desktop/aDrive-4.9.16.exe"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ArcanusNEO <admin@transcliff.top>
    
      2# Contributor: zhullyb < zhullyb [at] outook dot com >
    
      3# Contributor: sukanka < su975853527 [at] gmail dot com >
    
      4pkgname=adrive
    
      5url="https://www.aliyundrive.com/"
    
      6pkgrel=7
    
      7pkgver=4.9.16
    
      8pkgdesc="阿里云盘官方客户端app.asar提取版，直接调用系统electron运行"
    
      9arch=("x86_64")
    
      10license=("custom")
    
      11_electron=electron
    
      12depends=("$_electron" "python")
    
      13makedepends=('p7zip')
    
      14source=(
    
      15  "https://cdn.aliyundrive.net/downloads/apps/desktop/aDrive-4.9.16.exe"
    
      16  "aDrive.desktop"
    
      17  "aDrive.png"
    
      18  "aDrive.py"
    
      19)
    
      20sha256sums=('bb36e6204d6be7073ca9b13f273b55f788cd48dc9a849251a26b3239438b08d4'
    
      21            '057a9d329fce8775df05f24f108a280dbe3202381f8bc841c273ee34c6ae8b35'
    
      22            'fc2493439b0766992698acd3a7c74a1a90d2877699442b1d7c410d8606d74244'
    
      23            '238bcc948112710018e7fe6abfb5f4238ea5aef189271b7deeb88917f925865f')
    
      24
    
      25
    
      26prepare() {
    
      277z x aDrive-4.9.16.exe -o"${srcdir}/aDrive"
    
      28cat >aDrive.sh <<EOF
    
      29#!/bin/sh
    
      30set -eu
    
      31
    
      32export ELECTRON_FORCE_IS_PACKAGED=true
    
      33export ELECTRON_IS_DEV=0
    
      34
    
      35exec $_electron --no-sandbox /usr/lib/aDrive/app.asar "\$@"
    
      36
    
      37EOF
    
      38}
    
      39
    
      40package() {
    
      41  install -Dm644 ${srcdir}/aDrive/resources/app.asar -t ${pkgdir}/usr/lib/aDrive/
    
      42  install -Dm644 ${srcdir}/aDrive.png -t ${pkgdir}/usr/lib/aDrive/
    
      43  mkdir -p ${pkgdir}/usr/share/icons/hicolor/256x256/apps/
    
      44  ln -s /usr/lib/aDrive/aDrive.png ${pkgdir}/usr/share/icons/hicolor/256x256/apps/aDrive.png
    
      45
    
      46  install -Dm644 ${srcdir}/aDrive.desktop -t ${pkgdir}/usr/share/applications/
    
      47  install -Dm755 ${srcdir}/aDrive.sh ${pkgdir}/usr/lib/aDrive/aDrive.sh
    
      48  install -Dm755 ${srcdir}/aDrive.py ${pkgdir}/usr/bin/aDrive
    
      49  }
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2