alicorn-bin

maintainer unkown · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball (an Electron/Node.js launcher application) from pan.bilnn.com, which is a Chinese cloud file-sharing/pan service (similar to Baidu Pan). This is not an official release host — the upstream project (Andy-K-Sparklight/Alicorn) distributes releases via GitHub Releases, not via a third-party file-sharing service. File-sharing services like this allow silent content replacement without changing the URL, meaning the sha256sum provides integrity at the time of packaging but the URL could serve different content if the file is re-uploaded. The binary is installed and executed directly (Electron app with executable bits). While there is a sha256sum pinning the content, the non-official hosting of an executed binary is a genuine supply-chain concern: the maintainer could re-upload a malicious binary at any time and update the PKGBUILD with a new hash, or the file-sharing account could be compromised. This is a real medium-severity concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "${pkgname}-${pkgver}-${pkgrel}.tar.gz::https://pan.bilnn.com/api/v3/file/sourcejump/E5YQXbc9/qb3x77XW1_7hitnNK-JySdK3V7Xv92Y2u1GMgWkbNsY*")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball (an Electron/Node.js launcher application) from pan.bilnn.com, which is a Chinese cloud file-sharing/pan service (similar to Baidu Pan). This is not an official release host — the upstream project (Andy-K-Sparklight/Alicorn) distributes releases via GitHub Releases, not via a third-party file-sharing service. File-sharing services like this allow silent content replacement without changing the URL, meaning the sha256sum provides integrity at the time of packaging but the URL could serve different content if the file is re-uploaded. The binary is installed and executed directly (Electron app with executable bits). While there is a sha256sum pinning the content, the non-official hosting of an executed binary is a genuine supply-chain concern: the maintainer could re-upload a malicious binary at any time and update the PKGBUILD with a new hash, or the file-sharing account could be compromised. This is a real medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: UnKown <80520429 at domain dot com>
    
      2pkgname="alicorn-bin"
    
      3
    
      4pkgver="19.0.7"
    
      5pkgrel="1"
    
      6pkgdesc="这是 Alicorn，一个全新设计的启动器。"
    
      7
    
      8arch=("x86_64")
    
      9url="https://alc.pages.dev"
    
      10license=('GPL3')
    
      11
    
      12source=(
    
      13        "alicorn.png"
    
      14        "alicorn.desktop"
    
      15        "alicorn-launch-script"
    
      16        "LICENSE::https://github.com/Andy-K-Sparklight/Alicorn/blob/main/LICENSE"
    
      17        "${pkgname}-${pkgver}-${pkgrel}.tar.gz::https://pan.bilnn.com/api/v3/file/sourcejump/E5YQXbc9/qb3x77XW1_7hitnNK-JySdK3V7Xv92Y2u1GMgWkbNsY*")
    
      18sha256sums=('5832ef795d0d75233763ee94f7fa048902d2d74eaaad72ba704b9210861dc123'
    
      19            '4a67e1c8bb4417ba9ec7d84016d4a56af2ebf7b40f1f47b99f34ab36ae8f703e'
    
      20            'dc0ff9f12b9d90b8e2314977e9795a71935ad589e658363aaae9a94b010ea956'
    
      21            'fc9e71610f5e439786c7d639eb7626cedc5ad353a5880649bec856ffe685394a'
    
      22            '4f92bfb352aba05a990fdff8efd8f6ff91ab692af63aaa4a9fdfe43945cdd080')
    
      23
    
      24package() {
    
      25  install -d "${pkgdir}/usr/share/${pkgname}"
    
      26  cp -r "Alicorn-linux-x64/"* "${pkgdir}/usr/share/${pkgname}/" -R
    
      27  install -Dm644 "alicorn.png" "${pkgdir}/usr/share/${pkgname}/alicorn.png"
    
      28  install -Dm755 "alicorn-launch-script" "${pkgdir}/usr/bin/${pkgname}"
    
      29  install -Dm644 "alicorn.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      30  install -Dm644 "LICENSE" "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2