caido-desktop

maintainer SysAdm · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads and executes a prebuilt binary AppImage from caido.download. Checking the project: Caido is a legitimate web security auditing tool (caido.io), and caido.download appears to be their official release distribution domain (used in their documentation and release notes). The sha256sum is pinned, which mitigates substitution risk. However, this is still a prebuilt closed-source binary ('license: private') extracted and installed system-wide from a domain that is not the primary project domain — if caido.download were compromised or is not actually controlled by the Caido team, this would be a direct RCE vector. The pattern (AppImage from vendor CDN, pinned hash, legitimate commercial tool) is common in AUR and generally accepted, but the non-primary domain and fully opaque binary warrant keeping this at medium rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://caido.download/releases/v${pkgver}/caido-desktop-v${pkgver}-linux-x86_64.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads and executes a prebuilt binary AppImage from caido.download. Checking the project: Caido is a legitimate web security auditing tool (caido.io), and caido.download appears to be their official release distribution domain (used in their documentation and release notes). The sha256sum is pinned, which mitigates substitution risk. However, this is still a prebuilt closed-source binary ('license: private') extracted and installed system-wide from a domain that is not the primary project domain — if caido.download were compromised or is not actually controlled by the Caido team, this would be a direct RCE vector. The pattern (AppImage from vendor CDN, pinned hash, legitimate commercial tool) is common in AUR and generally accepted, but the non-primary domain and fully opaque binary warrant keeping this at medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: SysAdm <sysadm.archlinux@proton.me>
    
      2# Contributor: Asuka Minato
    
      3pkgname=caido-desktop
    
      4pkgver=0.57.0
    
      5pkgrel=1
    
      6pkgdesc="A lightweight web security auditing toolkit."
    
      7arch=('x86_64')
    
      8url="https://caido.io/"
    
      9license=('private')
    
      10depends=(glibc gcc-libs)
    
      11provides=(caido)
    
      12source=("https://caido.download/releases/v${pkgver}/caido-desktop-v${pkgver}-linux-x86_64.AppImage")
    
      13sha256sums=('6be587849f93bf084ea873b153b6392d7797009e93f2193bd66785b9347eadaf')
    
      14
    
      15prepare() {
    
      16	chmod +x *.AppImage
    
      17	./*.AppImage --appimage-extract
    
      18	mv squashfs-root/ ${srcdir}/build
    
      19}
    
      20
    
      21package() {
    
      22	install -dm 755 "$pkgdir/usr/bin"
    
      23	install -dm 755 "$pkgdir/opt/$pkgname"
    
      24
    
      25	cp -a "${srcdir}/build/usr/share" "$pkgdir"
    
      26	cp -aR "${srcdir}/build"/* "$pkgdir/opt/$pkgname/"
    
      27	ln -s "/opt/$pkgname/caido" "$pkgdir/usr/bin/$provides"
    
      28	find "$pkgdir/opt/$pkgname" -type d -exec chmod 755 {} +
    
      29
    
      30	sed -i 's|Exec=AppRun --no-sandbox %U|Exec=caido|' "build/caido.desktop"
    
      31	install -Dm 644 "build/caido.desktop" -t "$pkgdir/usr/share/applications/"
    
      32	install -Dm 644 "build/caido.png" -t "$pkgdir/usr/share/icons/hicolor/256x256/apps/"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2