cad-viewer-bin

maintainer 4ni1ak · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt web assets and a main.js file from a GitHub release and raw content URL; while the hosts are not whitelisted, the content is static web data and launcher scripts for a local Electron app, with no evidence of obfuscated code or remote code execution, and the worst case of a malicious swap would be limited to serving malicious JavaScript in a sandboxed viewer.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt web assets and a main.js file from a GitHub release and raw content URL; while the hosts are not whitelisted, the content is static web data and launcher scripts for a local Electron app, with no evidence of obfuscated code or remote code execution, and the worst case of a malicious swap would be limited to serving malicious JavaScript in a sandboxed viewer.

PKGBUILD

      1# Maintainer: Anıl Akpınar <meme4empty@gmail.com>
    
      2pkgname=cad-viewer-bin
    
      3_pkgname=cad-viewer
    
      4pkgver=1.5.8
    
      5pkgrel=1
    
      6pkgdesc="Browser-based DWG/DXF CAD viewer, packaged as a desktop app on system Electron (prebuilt)"
    
      7arch=('any')
    
      8url="https://github.com/mlightcad/cad-viewer"
    
      9license=('MIT')
    
      10depends=('electron' 'bash' 'hicolor-icon-theme')
    
      11provides=('cad-viewer')
    
      12conflicts=('cad-viewer')
    
      13source=("cad-viewer-web-dist-$pkgver.tar.gz::https://github.com/4ni1ak/cad-viewer/releases/download/v$pkgver/cad-viewer-web-dist-$pkgver.tar.gz"
    
      14        "mlightcad.svg::https://raw.githubusercontent.com/mlightcad/cad-viewer/v$pkgver/packages/cad-viewer/src/svg/mlightcad.svg"
    
      15        'cad-viewer-main.js'
    
      16        'cad-viewer.desktop'
    
      17        'cad-viewer.sh')
    
      18sha256sums=('96bb0e2c47c71085e294dd10c1743b1e8fcb5c73ba4b6009ff25790e696a3f11'
    
      19            'b12e457c262af86f910578ef8b228d4fb2747802ea19f9b2f18e63a391e17142'
    
      20            '69172019cdfb40c8777d336ecd083ddc7892a938a4e3161d8f3095b69fa06fef'
    
      21            'f5c19db2b6aa8357b3a1f34e5ff2bdddf19d4a8fcf43ccac4f12e651b68a70eb'
    
      22            'e9d8c7dede097c64e3414c58872dfcc593aa6d1eb37e5896fb2d9a16d573ae00')
    
      23
    
      24package() {
    
      25  install -dm755 "$pkgdir/usr/lib/cad-viewer"
    
      26  cp -r "$srcdir/web" "$pkgdir/usr/lib/cad-viewer/web"
    
      27  install -Dm644 "$srcdir/cad-viewer-main.js" "$pkgdir/usr/lib/cad-viewer/main.js"
    
      28
    
      29  install -Dm755 "$srcdir/cad-viewer.sh" "$pkgdir/usr/bin/cad-viewer"
    
      30  install -Dm644 "$srcdir/cad-viewer.desktop" \
    
      31    "$pkgdir/usr/share/applications/cad-viewer.desktop"
    
      32  install -Dm644 "$srcdir/mlightcad.svg" \
    
      33    "$pkgdir/usr/share/icons/hicolor/scalable/apps/cad-viewer.svg"
    
      34  install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 23:28:32	LOW	2