badlion-client

maintainer xominf · 9 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage binary (an Electron/Chromium-based Minecraft client) directly from client-updates-cdn77.badlion.net — a CDN domain operated by Badlion, not a standard code-hosting platform like GitHub releases. The binary is executed during build (./BadlionClient --appimage-extract) and then installed to /opt. While Badlion is a known, legitimate Minecraft client service and the CDN domain is plausibly their own infrastructure, the source is a versioned binary blob from a non-standard host with no GPG signature — only a b2sum. If the CDN were compromised or the URL silently redirected, arbitrary code would execute on the builder's machine and be installed system-wide. This is a textbook supply-chain medium: a real executed binary from an unofficial/non-canonical host (not GitHub, not the distro's own mirror), with no cryptographic signing beyond a hash that only the PKGBUILD maintainer controls. The auto-update removal is a minor positive. Overall this is a legitimate medium risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=('BadlionClient::https://client-updates-cdn77.badlion.net/BadlionClient'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt AppImage binary (an Electron/Chromium-based Minecraft client) directly from client-updates-cdn77.badlion.net — a CDN domain operated by Badlion, not a standard code-hosting platform like GitHub releases. The binary is executed during build (./BadlionClient --appimage-extract) and then installed to /opt. While Badlion is a known, legitimate Minecraft client service and the CDN domain is plausibly their own infrastructure, the source is a versioned binary blob from a non-standard host with no GPG signature — only a b2sum. If the CDN were compromised or the URL silently redirected, arbitrary code would execute on the builder's machine and be installed system-wide. This is a textbook supply-chain medium: a real executed binary from an unofficial/non-canonical host (not GitHub, not the distro's own mirror), with no cryptographic signing beyond a hash that only the PKGBUILD maintainer controls. The auto-update removal is a minor positive. Overall this is a legitimate medium risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer MatthieuDev <contact at matthieul dot dev>
    
      2# Submitter Wings-Fantasy <1056947073@qq.com>
    
      3
    
      4pkgname=badlion-client
    
      5pkgver=4.5.4
    
      6pkgrel=2
    
      7pkgdesc="A Minecraft client with anti-cheat protection"
    
      8url="https://client.badlion.net"
    
      9arch=('x86_64')
    
      10license=('custom')
    
      11provides=('BadlionClient')
    
      12source=('BadlionClient::https://client-updates-cdn77.badlion.net/BadlionClient'
    
      13'AppRun'
    
      14'BadlionClient.desktop')
    
      15b2sums=('efdae91ee731df35eb3bb88cc2317c02f62544ca29ff529df5be0deaa659a4274be460a791b732b5c4070adfcb553c008c5fc58656a7270162edbd5c41d9d743'
    
      16        '42865a8a9ee9c71a1472fe82554e5b12df59a89a81cb28d2e0e942c59529781724f70c58802dbbb8905f62e0b413665322fcdb2095e8ebb681250456fda2645d'
    
      17        '31f87ca073b6b587adc6d6e09846c7d8c143c6140198e7b8fb93fb1d5525b75cd1fd945f138b8b40a4d830a881d34f8d31829f89e8c6ac3de49ee115986e0097')
    
      18
    
      19prepare() {
    
      20    chmod a+x BadlionClient
    
      21    ./BadlionClient --appimage-extract > /dev/null
    
      22    cd "squashfs-root"
    
      23    rm -rf "AppRun" "BadlionClient.desktop" "BadlionClient.png" ".DirIcon" "licenses" "LICENSE.electron.txt" "LICENSES.chromium.html"
    
      24}
    
      25
    
      26package() {
    
      27    cd "${srcdir}"
    
      28    install -Dm644 BadlionClient.desktop "${pkgdir}/usr/share/applications/BadlionClient.desktop"
    
      29    install -Dm755 AppRun "${pkgdir}/opt/BadlionClient/AppRun"
    
      30
    
      31    cd "squashfs-root"
    
      32    mkdir -p "$pkgdir/usr/share/licenses/BadlionClient"
    
      33    mv license.txt "$pkgdir/usr/share/licenses/BadlionClient"
    
      34    cp -r usr/share "$pkgdir/usr"
    
      35    rm -rf usr/share
    
      36    cp -r * "$pkgdir/opt/BadlionClient"
    
      37    chmod -R go+rX "$pkgdir/usr/share/icons"
    
      38    cd "$pkgdir/opt/BadlionClient"
    
      39    chmod 755 cursors libs locales native-modules resources usr usr/lib
    
      40
    
      41    # Badlion don't start if not defined
    
      42    sed -i -e '/APPDIR=/a\' -e 'export APPIMAGE="true"' AppRun
    
      43    # Remove auto-update system
    
      44    rm resources/app-update.yml
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2