catalystplus-desktop-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage from assets.catalystplus.cn, which is the official CDN for the CatalystPlus (催化剂加) desktop application by ResearcherCosmos. The AppImage is extracted and its app.asar (Electron application bundle) is installed system-wide. While catalystplus.cn appears to be the legitimate vendor domain matching the application's official website (researchercosmos.com), the binary is still a prebuilt executable from a Chinese research platform's CDN with no way to verify the build provenance beyond the sha256sum. The AppImage is also executed during the build (--appimage-extract) which runs the bundled runtime. This is a standard pattern for AUR AppImage packages, but the combination of an executed foreign binary from a non-GitHub/non-major-forge host and installation of its app.asar (which contains all application JS code) warrants a medium rating. There is no obfuscation, no exfiltration attempt, and no piracy concern — this is the vendor's own software distributed through their own CDN, which is a legitimate if non-ideal supply-chain pattern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 "${pkgname%-bin}-${pkgver}.AppImage::https://assets.catalystplus.cn/CatalystPlusDesktopPackage/linux/%E5%82%AC%E5%8C%96%E5%89%82%E5%8A%A0%20${_pkgname}-${pkgver}.AppImage"
PKGBUILD:22 "LICENSE.html::https://www.researchercosmos.com/docs/terms"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage from assets.catalystplus.cn, which is the official CDN for the CatalystPlus (催化剂加) desktop application by ResearcherCosmos. The AppImage is extracted and its app.asar (Electron application bundle) is installed system-wide. While catalystplus.cn appears to be the legitimate vendor domain matching the application's official website (researchercosmos.com), the binary is still a prebuilt executable from a Chinese research platform's CDN with no way to verify the build provenance beyond the sha256sum. The AppImage is also executed during the build (--appimage-extract) which runs the bundled runtime. This is a standard pattern for AUR AppImage packages, but the combination of an executed foreign binary from a non-GitHub/non-major-forge host and installation of its app.asar (which contains all application JS code) warrants a medium rating. There is no obfuscation, no exfiltration attempt, and no piracy concern — this is the vendor's own software distributed through their own CDN, which is a legitimate if non-ideal supply-chain pattern.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=catalystplus-desktop-bin
    
      3_pkgname=CatalystPlus
    
      4pkgver=3.8.2
    
      5_electronversion=22
    
      6pkgrel=2
    
      7pkgdesc="A multi-terminal and interoperable scientific research professional information aggregation platform client to improve the efficiency of researchers' access to the latest research results in the field.(Prebuilt version.Use system-wide electron)"
    
      8arch=('x86_64')
    
      9url="https://www.researchercosmos.com/"
    
      10license=('MIT')
    
      11provides=("${pkgname%-bin}=${pkgver}")
    
      12conflicts=("${pkgname%-bin}")
    
      13depends=(
    
      14    "electron${_electronversion}"
    
      15    'xpdf'
    
      16)
    
      17makedepends=(
    
      18    'fuse2'
    
      19)
    
      20source=(
    
      21    "${pkgname%-bin}-${pkgver}.AppImage::https://assets.catalystplus.cn/CatalystPlusDesktopPackage/linux/%E5%82%AC%E5%8C%96%E5%89%82%E5%8A%A0%20${_pkgname}-${pkgver}.AppImage"
    
      22    "LICENSE.html::https://www.researchercosmos.com/docs/terms"
    
      23    "${pkgname%-bin}.sh"
    
      24)
    
      25sha256sums=('23d70f8d388abd9ab24b8ebd90a8dacfbb94d29d3addb791842945a390ee262d'
    
      26            'b56c7e5caa0e331d5fa168c2455c8105bb67f69b6ee4808fd9faac85f49430fd'
    
      27            '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
    
      28prepare() {
    
      29    sed -i -e "
    
      30        s/@electronversion@/${_electronversion}/g
    
      31        s/@appname@/${pkgname%-bin}/g
    
      32        s/@runname@/app.asar/g
    
      33        s/@cfgdirname@/${pkgname%-bin}/g
    
      34        s/@options@//g
    
      35    " "${srcdir}/${pkgname%-bin}.sh"
    
      36    if [ ! -x "${srcdir}/${pkgname%-bin}-${pkgver}.AppImage" ];then
    
      37        chmod +x "${srcdir}/${pkgname%-bin}-${pkgver}.AppImage"
    
      38    fi
    
      39    "${srcdir}/${pkgname%-bin}-${pkgver}.AppImage" --appimage-extract > /dev/null
    
      40    sed -i "s/AppRun --no-sandbox/${pkgname%-bin}/g" "${srcdir}/squashfs-root/${pkgname%-bin}.desktop"
    
      41    find "${srcdir}/squashfs-root/resources" -type d -exec chmod 755 {} +
    
      42    ln -sf "/usr/bin/xpdf" "${srcdir}/squashfs-root/resources/app.asar.unpacked/resources/xpdf.exe"
    
      43}
    
      44package() {
    
      45    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      46    install -Dm644 "${srcdir}/squashfs-root/resources/app.asar" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      47    cp -Pr --no-preserve=ownership "${srcdir}/squashfs-root/resources/app.asar.unpacked" "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      48    _icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
    
      49    for _icons in "${_icon_sizes[@]}";do
    
      50        install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-bin}.png" \
    
      51            -t "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps"
    
      52    done
    
      53    install -Dm644 "${srcdir}/squashfs-root/${pkgname%-bin}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      54    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      55}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2