apifox

MEDIUM

maintainer duanluan 9 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary archive from an Alibaba Cloud OSS bucket (non-standard, non-official host) with a fixed checksum, posing a supply-chain risk if the source were swapped, though no active malicious behavior is evident.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:50 "${_source_archive}::https://file-assets-cdn.oss-cn-hangzhou.aliyuncs.com/download/Apifox-linux-manual-latest.tar.gz"

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary archive from an Alibaba Cloud OSS bucket (non-standard, non-official host) with a fixed checksum, posing a supply-chain risk if the source were swapped, though no active malicious behavior is evident.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=apifox
    
      4pkgver=2.8.46
    
      5pkgrel=2
    
      6pkgdesc='API documentation, debugging, mocking, and automated testing tool'
    
      7arch=('x86_64')
    
      8url='https://apifox.com/'
    
      9license=('LicenseRef-Proprietary')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'cairo'
    
      14  'dbus'
    
      15  'expat'
    
      16  'gcc-libs'
    
      17  'glib2'
    
      18  'glibc'
    
      19  'gtk3'
    
      20  'hicolor-icon-theme'
    
      21  'libcups'
    
      22  'libnotify'
    
      23  'libsecret'
    
      24  'libx11'
    
      25  'libxcb'
    
      26  'libxcomposite'
    
      27  'libxdamage'
    
      28  'libxext'
    
      29  'libxfixes'
    
      30  'libxkbcommon'
    
      31  'libxrandr'
    
      32  'libxss'
    
      33  'libxtst'
    
      34  'mesa'
    
      35  'nspr'
    
      36  'nss'
    
      37  'pango'
    
      38  'systemd-libs'
    
      39  'util-linux-libs'
    
      40  'xdg-utils'
    
      41)
    
      42optdepends=(
    
      43  'java-runtime: run the bundled Java database executors'
    
      44  'libappindicator-gtk3: system tray icon support'
    
      45)
    
      46conflicts=('api-fox-bin' 'apifox-bin' 'apifox-appimage')
    
      47options=('!strip' '!lto')
    
      48_source_archive="Apifox-linux-manual-${pkgver}.tar.gz"
    
      49source=(
    
      50  "${_source_archive}::https://file-assets-cdn.oss-cn-hangzhou.aliyuncs.com/download/Apifox-linux-manual-latest.tar.gz"
    
      51  'apifox.desktop'
    
      52  'apifox.png'
    
      53)
    
      54sha256sums=(
    
      55  '2bb6b678596aa61a67fd6e05e6f8426f41e36aa0df16ff5bd3c0329523056c79'
    
      56  '4478f9ad5f70828608bde15a50fe700a6b8ff83d632dd065bac4bcbd3eedbe9e'
    
      57  'b3d3b84f5a5f35ef8a85b0db3ddcb239fb982ee8a6d53a5fb81ed296021fb44a'
    
      58)
    
      59
    
      60package() {
    
      61  local upstream_dir="${srcdir}/apifox-${pkgver}"
    
      62  local install_root="${pkgdir}/opt/Apifox"
    
      63
    
      64  for required_path in \
    
      65    "${upstream_dir}/apifox" \
    
      66    "${upstream_dir}/chrome-sandbox" \
    
      67    "${upstream_dir}/resources/app.asar" \
    
      68    "${upstream_dir}/resources/app.asar.unpacked/package.json" \
    
      69    "${upstream_dir}/LICENSE.electron.txt" \
    
      70    "${upstream_dir}/LICENSES.chromium.html"; do
    
      71    [[ -e "${required_path}" ]] || {
    
      72      printf 'missing required upstream path: %s\n' "${required_path}" >&2
    
      73      return 1
    
      74    }
    
      75  done
    
      76
    
      77  install -dm755 "${install_root}"
    
      78  cp -a "${upstream_dir}/." "${install_root}/"
    
      79
    
      80  install -dm755 "${pkgdir}/usr/bin"
    
      81  ln -s "/opt/Apifox/apifox" "${pkgdir}/usr/bin/apifox"
    
      82
    
      83  # Electron's sandbox helper must retain its setuid bit for sandboxed renderers.
    
      84  chmod 4755 "${install_root}/chrome-sandbox"
    
      85
    
      86  install -Dm644 "${srcdir}/apifox.desktop" \
    
      87    "${pkgdir}/usr/share/applications/apifox.desktop"
    
      88  # Official app logo (upstream app.asar.unpacked/dist/assets/logo.png,
    
      89  # resized to 512x512). Installed into 512x512 because hicolor's index.theme
    
      90  # declares no 1024x1024 directory, so icons placed there are never found.
    
      91  install -Dm644 "${srcdir}/apifox.png" \
    
      92    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/apifox.png"
    
      93
    
      94  install -Dm644 "${upstream_dir}/LICENSE.electron.txt" \
    
      95    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      96  install -Dm644 "${upstream_dir}/LICENSES.chromium.html" \
    
      97    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      98}
    
      99

Changes since previous scan

--- PKGBUILD @ 2026-09-08 00:18
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,8 +1,8 @@
 # Maintainer: duanluan <duanluan@outlook.com>
 
 pkgname=apifox
-pkgver=2.8.45
-pkgrel=1
+pkgver=2.8.46
+pkgrel=2
 pkgdesc='API documentation, debugging, mocking, and automated testing tool'
 arch=('x86_64')
 url='https://apifox.com/'
@@ -49,10 +49,12 @@
 source=(
   "${_source_archive}::https://file-assets-cdn.oss-cn-hangzhou.aliyuncs.com/download/Apifox-linux-manual-latest.tar.gz"
   'apifox.desktop'
+  'apifox.png'
 )
 sha256sums=(
-  '150370746271beeb73a23c73100f2672053dec95f145f6a3a63eebc9f40c5e8c'
-  '86dbe67fed5b4159d14ed5c3cdf1415714f8a48033ad9f8f0debfae704de35ca'
+  '2bb6b678596aa61a67fd6e05e6f8426f41e36aa0df16ff5bd3c0329523056c79'
+  '4478f9ad5f70828608bde15a50fe700a6b8ff83d632dd065bac4bcbd3eedbe9e'
+  'b3d3b84f5a5f35ef8a85b0db3ddcb239fb982ee8a6d53a5fb81ed296021fb44a'
 )
 
 package() {
@@ -64,7 +66,6 @@
     "${upstream_dir}/chrome-sandbox" \
     "${upstream_dir}/resources/app.asar" \
     "${upstream_dir}/resources/app.asar.unpacked/package.json" \
-    "${upstream_dir}/resources/app.asar.unpacked/dist/assets/logo.png" \
     "${upstream_dir}/LICENSE.electron.txt" \
     "${upstream_dir}/LICENSES.chromium.html"; do
     [[ -e "${required_path}" ]] || {
@@ -84,9 +85,11 @@
 
   install -Dm644 "${srcdir}/apifox.desktop" \
     "${pkgdir}/usr/share/applications/apifox.desktop"
-  install -Dm644 \
-    "${upstream_dir}/resources/app.asar.unpacked/dist/assets/logo.png" \
-    "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/apifox.png"
+  # Official app logo (upstream app.asar.unpacked/dist/assets/logo.png,
+  # resized to 512x512). Installed into 512x512 because hicolor's index.theme
+  # declares no 1024x1024 directory, so icons placed there are never found.
+  install -Dm644 "${srcdir}/apifox.png" \
+    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/apifox.png"
 
   install -Dm644 "${upstream_dir}/LICENSE.electron.txt" \
     "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	3
2026-09-16 00:03:17	Medium	3
2026-09-15 13:19:52	Medium	3
2026-09-15 00:25:31	Medium	3
2026-09-14 00:27:57	Medium	3
2026-09-13 00:19:54	Medium	3
2026-09-12 00:25:17	Medium	3
2026-09-11 00:19:22	Medium	3
2026-09-10 00:22:44	Medium	3
2026-09-09 00:04:09	Medium	3
2026-09-08 15:17:32	Medium	3
2026-09-08 00:18:08	Low	3
2026-09-07 07:13:50	Medium	2
2026-09-07 05:13:32	Medium	2
2026-09-07 00:30:15	Low	3
2026-09-06 17:12:21	Medium	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2