balonet

maintainer hlat · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from cdn.balonet.net, which is the official CDN for the balonet.net service (same domain as the project URL). This is not a random personal host — it is the vendor's own CDN. However, it is still a proprietary prebuilt binary (Electron/Node.js app based on the depends and node_modules path) extracted and installed directly, with no source build. The sha512sum is present and pins the specific binary, which mitigates substitution risk somewhat. The concern is that this is closed-source prebuilt code from a relatively obscure vendor with no way to audit what the binary does, and the CDN could theoretically serve different content to different requesters. This is a classic medium-severity supply-chain pattern: executed binary from a vendor-controlled but non-auditable host, not a clearly malicious or high-severity attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=("https://cdn.balonet.net/files/linux/$pkgname-$pkgver.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from cdn.balonet.net, which is the official CDN for the balonet.net service (same domain as the project URL). This is not a random personal host — it is the vendor's own CDN. However, it is still a proprietary prebuilt binary (Electron/Node.js app based on the depends and node_modules path) extracted and installed directly, with no source build. The sha512sum is present and pins the specific binary, which mitigates substitution risk somewhat. The concern is that this is closed-source prebuilt code from a relatively obscure vendor with no way to audit what the binary does, and the CDN could theoretically serve different content to different requesters. This is a classic medium-severity supply-chain pattern: executed binary from a vendor-controlled but non-auditable host, not a clearly malicious or high-severity attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: hadi latifi <m313hl at gmail dot com>
    
      2# Contributor: zamin <dev at zamin dot link>
    
      3pkgname=balonet
    
      4pkgver=3.0.0
    
      5pkgrel=1
    
      6pkgdesc="Balonet is a social network, focused on working environment. Balonet helps to address communication and coordination needs of small startups and development groups up to big organizations."
    
      7arch=('x86_64')
    
      8url="https://balonet.net"
    
      9license=('Apache-2.0')
    
      10depends=('gconf' 'gdk-pixbuf2' 'glib2' 'gtk3' 'hicolor-icon-theme' 'libappindicator-gtk2' 'libnotify' 'libxss' 'libxtst' 'nss')
    
      11options=('!strip' '!emptydirs')
    
      12install=${pkgname}.install
    
      13source_x86_64=("https://cdn.balonet.net/files/linux/$pkgname-$pkgver.deb")
    
      14sha512sums_x86_64=('956572b95df37b6c77653db800233cc40c1906a518db25c538750e9e6832192fe7e90594e50689d17ef7c39926367fc7eb6b81ca753713c465f6e55e5b1fe769')
    
      15
    
      16package(){
    
      17
    
      18	# Extract package data
    
      19	tar xf data.tar.xz -C "${pkgdir}"
    
      20	install -D -m644 "/opt/balonet/resources/app/node_modules/universalify/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      21
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2