ajclassic-grapefruit

maintainer themirrazz · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows NSIS installer archive (aj-classic-1.5.7-ia32.nsis.7z) from classic-download.animaljam.com, extracts an app.asar from it, and installs it as the game runtime. While classic-download.animaljam.com appears to be the official Animal Jam Classic distribution host (WildWorks/AJHQ), it is not a standard Linux package mirror and the package is a Windows binary being repurposed on Linux. The app.asar (an Electron application archive containing executable JavaScript) is extracted and installed directly to /usr/lib, then executed via a launcher script. The sha256 checksum provides integrity verification against the specific downloaded file, but the source is a personal GitHub repo (raw.githubusercontent.com/themirrazz) pulling a Windows game binary and wrapping it with custom Node.js shims including a 'rmsandbox' module that unconditionally exports 'true' — suggesting it bypasses some sandbox check in the original application. The combination of: (1) a prebuilt binary .asar from a CDN, (2) custom shim modules injected into node_modules to override sandbox/path behavior, and (3) execution of Windows game code via Electron on Linux constitutes a real supply-chain concern. The checksums mitigate substitution risk but do not address the trustworthiness of the upstream CDN content or the sandbox-bypass shim. This is a legitimate medium-severity concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "ajclassic.7z::https://classic-download.animaljam.com/win/aj-classic-1.5.7-ia32.nsis.7z"
PKGBUILD:18 "gameicon.png::https://cdn2.steamgriddb.com/icon_thumb/69daeea8d60db98c428f11dc980effdc.png"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows NSIS installer archive (aj-classic-1.5.7-ia32.nsis.7z) from classic-download.animaljam.com, extracts an app.asar from it, and installs it as the game runtime. While classic-download.animaljam.com appears to be the official Animal Jam Classic distribution host (WildWorks/AJHQ), it is not a standard Linux package mirror and the package is a Windows binary being repurposed on Linux. The app.asar (an Electron application archive containing executable JavaScript) is extracted and installed directly to /usr/lib, then executed via a launcher script. The sha256 checksum provides integrity verification against the specific downloaded file, but the source is a personal GitHub repo (raw.githubusercontent.com/themirrazz) pulling a Windows game binary and wrapping it with custom Node.js shims including a 'rmsandbox' module that unconditionally exports 'true' — suggesting it bypasses some sandbox check in the original application. The combination of: (1) a prebuilt binary .asar from a CDN, (2) custom shim modules injected into node_modules to override sandbox/path behavior, and (3) execution of Windows game code via Electron on Linux constitutes a real supply-chain concern. The checksums mitigate substitution risk but do not address the trustworthiness of the upstream CDN content or the sandbox-bypass shim. This is a legitimate medium-severity concern.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: themirrazz <themirrazzxyz@outlook.com>
    
      2pkgname=ajclassic-grapefruit
    
      3pkgdesc="Lightweight launcher and runtime for AJ Classic"
    
      4pkgver=1.0.1
    
      5url="https://github.com/themirrazz/grapefruit"
    
      6pkgrel=11
    
      7arch=("x86_64")
    
      8provides=("ajclassic-bin")
    
      9conflicts=("ajclassic-bin"
    
      10           "ajceverywhere-bin")
    
      11license=('custom')
    
      12options=('!strip' '!debug')
    
      13source=("index.js::https://raw.githubusercontent.com/themirrazz/grapefruit/refs/heads/main/index.js"
    
      14        "package.json::https://raw.githubusercontent.com/themirrazz/grapefruit/refs/heads/main/package.json"
    
      15        "launcher.sh::https://raw.githubusercontent.com/themirrazz/grapefruit/refs/heads/main/aur/launcher-2.0.sh"
    
      16        "ajclassic-grapefruit.desktop::https://raw.githubusercontent.com/themirrazz/grapefruit/refs/heads/main/aur/grapefruit.desktop"
    
      17        "ajclassic.7z::https://classic-download.animaljam.com/win/aj-classic-1.5.7-ia32.nsis.7z"
    
      18        "gameicon.png::https://cdn2.steamgriddb.com/icon_thumb/69daeea8d60db98c428f11dc980effdc.png"
    
      19    )
    
      20sha256sums=("102600833526e785ab9b3e81191ea0cfb212ae7bc49adb51230cec936278635d"
    
      21            "4654808108b59a68a8855e1d7d50ae000904e62e08d56989517b347544a0a8f6"
    
      22            "74fcedaf5eb785d0dff579424594a86ea6ff623582096e43b6b15ba9ecc75349"
    
      23            "adca639c6f961e66e65525c8803b490338386f734829974c06be6a4cd6e7a138"
    
      24            "c8eb7129c449cec60e8b17252c228cc96eebbf7bc307601061ea72a17248e286"
    
      25            "cee0e7c2a101fe220635ba99c3b993abcac6305d789dbcb1d2476abb0aa85287")
    
      26
    
      27prepare() {
    
      28    mkdir ajclassic-grapefruit
    
      29    mv index.js ajclassic-grapefruit/index.js
    
      30    mv package.json ajclassic-grapefruit/package.json
    
      31    7z e ajclassic.7z resources/app.asar
    
      32    mv app.asar ajclassic-grapefruit/game.asar
    
      33    echo -n "1.5.7" > ajclassic-grapefruit/game-version.lock
    
      34    mkdir bins
    
      35    cp launcher.sh bins/aj-classic
    
      36    cp launcher.sh bins/ajclassic-grapefruit
    
      37    mkdir -p ajclassic-grapefruit/node_modules/rmsandbox
    
      38    mkdir -p ajclassic-grapefruit/node_modules/libdir
    
      39    echo -n "module.exports = true;" > ajclassic-grapefruit/node_modules/rmsandbox/index.js
    
      40    echo -n '{"name":"rmsandbox","version":"1.0.0","description":"","keywords":[],"main":"index.js","type":"commonjs"}' > ajclassic-grapefruit/node_modules/rmsandbox/package.json
    
      41    echo -n 'const path=require("path");module.exports={gameAsar:"/usr/lib/ajclassic-grapefruit/game.asar",gameLock:"/usr/lib/ajclassic-grapefruit/game-version.lock",pepperFlash:"/lib/PepperFlash/libpepflashplayer.so",libinstall:"/usr/lib/ajclassic-grapefruit/libinstall.js",everyUpdater:"/usr/lib/ajclassic-grapefruit/everyUpdater.js",electronUpdater:"/usr/lib/ajclassic-grapefruit/game.asar/node_modules/electron-updater",gameConfig:"/usr/lib/ajclassic-grapefruit/game.asar/config.js",gameEntry:"/usr/lib/ajclassic-grapefruit/game.asar/index.js"};' > ajclassic-grapefruit/node_modules/libdir/libdir.js
    
      42    echo -n '{"name":"libdir","version":"1.0.0","type":"commonjs","main":"libdir.js"}' > ajclassic-grapefruit/node_modules/libdir/package.json
    
      43}
    
      44
    
      45package() {
    
      46    cd bins
    
      47    install -Dm755 -t "$pkgdir/usr/bin" aj-classic
    
      48    install -Dm755 -t "$pkgdir/usr/bin" ajclassic-grapefruit
    
      49    cd ..
    
      50    install -Dm755 -t "$pkgdir/usr/share/applications" ajclassic-grapefruit.desktop
    
      51    mkdir -p "$pkgdir/usr/lib"
    
      52    cd ajclassic-grapefruit
    
      53    install -Dm755 -t "$pkgdir/usr/lib/ajclassic-grapefruit" index.js package.json game.asar game-version.lock
    
      54    cd node_modules/libdir
    
      55    install -Dm755 -t "$pkgdir/usr/lib/ajclassic-grapefruit/node_modules/libdir" libdir.js package.json
    
      56    cd ../rmsandbox
    
      57    install -Dm755 -t "$pkgdir/usr/lib/ajclassic-grapefruit/node_modules/rmsandbox" index.js package.json
    
      58    cd ../../..
    
      59    cp gameicon.png $pkgdir/usr/lib/ajclassic-grapefruit/gameicon.png
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2