catpaw

MEDIUM

maintainer lzsnyy 0 votes scanned 2026-11-03 14:06:57.695390

View on AUR

Why flagged

The package downloads a prebuilt macOS DMG from a non-project S3 host (s3-fra01-eu.mykeeta.net) and a prebuilt CLI binary from an unrelated Meituan S3 bucket (s3plus.meituan.net), both of which are unofficial, unverifiable sources that could be silently swapped; while checksums are provided for all sources, the binary artifacts come from personal/CDN hosts unrelated to the official catpaw.com infrastructure, making supply-chain substitution a realistic risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 "catpaw-${pkgver}.dmg::https://s3-fra01-eu.mykeeta.net/catpaw-overseas/ide/darwin/stable/${pkgver}/catpaw.20260929170804.dmg"
PKGBUILD:34 "node-v${_electron}-headers.tar.gz::https://artifacts.electronjs.org/headers/dist/v${_electron}/node-v${_electron}-headers.tar.gz"
PKGBUILD:49 'catpaw-cli-linux-x64-1.2.0-beta.19::https://s3plus.meituan.net/mcopilot-pub/cli/v1.2.0-beta.19/catpaw-cli-linux-x64'

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): The package downloads a prebuilt macOS DMG from a non-project S3 host (s3-fra01-eu.mykeeta.net) and a prebuilt CLI binary from an unrelated Meituan S3 bucket (s3plus.meituan.net), both of which are unofficial, unverifiable sources that could be silently swapped; while checksums are provided for all sources, the binary artifacts come from personal/CDN hosts unrelated to the official catpaw.com infrastructure, making supply-chain substitution a realistic risk.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: mensylisir <710080675@qq.com>
    
      2
    
      3pkgname=catpaw
    
      4pkgver=2026.0929.1642
    
      5pkgrel=1
    
      6_electron=42.11.2
    
      7_node=24.18.0
    
      8_python=3.12.13
    
      9pkgdesc='CatPaw AI Agent 桌面应用（国际版），非官方 Linux 移植'
    
      10arch=('x86_64')
    
      11url='https://catpaw.com/'
    
      12license=('custom')
    
      13depends=(
    
'gtk3' 'nss' 'alsa-lib' 'libcups' 'libdrm' 'libx11' 'libxcb'
    
'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxi'
    
'libxkbcommon' 'libxrandr' 'mesa' 'libsecret'
    
'libappindicator' 'libpulse' 'json-glib' 'wayland' 'systemd-libs' 'dbus'
    
'libnotify'
    
      19)
    
      20makedepends=('7zip' 'unzip' 'nodejs' 'node-gyp' 'python' 'gcc' 'make')
    
      21optdepends=(
    
'libreoffice-fresh: PPTX 转 PDF/图片'
    
'poppler: PDF 渲染与转换（pdftoppm）'
    
'pandoc-cli: DOCX 高级文本转换'
    
'tesseract: OCR 识别'
    
'qpdf: PDF 处理'
    
'gnome-keyring: 系统密钥环支持'
    
      28)
    
      29options=('!strip' '!debug' '!lto')
    
      30
    
      31source=(
    
"catpaw-${pkgver}.dmg::https://s3-fra01-eu.mykeeta.net/catpaw-overseas/ide/darwin/stable/${pkgver}/catpaw.20260929170804.dmg"
    
"electron-v${_electron}-linux-x64.zip::https://github.com/electron/electron/releases/download/v${_electron}/electron-v${_electron}-linux-x64.zip"
    
"node-v${_electron}-headers.tar.gz::https://artifacts.electronjs.org/headers/dist/v${_electron}/node-v${_electron}-headers.tar.gz"
    
"node-v${_node}-linux-x64.tar.gz::https://nodejs.org/dist/v${_node}/node-v${_node}-linux-x64.tar.gz"
    
"cpython-${_python}-linux-x64-install_only.tar.gz::https://github.com/astral-sh/python-build-standalone/releases/download/20260807/cpython-${_python}%2B20260807-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
    
'node-pty-1.1.0.tgz::https://registry.npmjs.org/node-pty/-/node-pty-1.1.0.tgz'
    
'node-addon-api-7.1.1.tgz::https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz'
    
'bufferutil-4.1.0.tgz::https://registry.npmjs.org/bufferutil/-/bufferutil-4.1.0.tgz'
    
'utf-8-validate-6.0.6.tgz::https://registry.npmjs.org/utf-8-validate/-/utf-8-validate-6.0.6.tgz'
    
'better-sqlite3-v12.11.1-electron-v146-linux-x64.tar.gz::https://github.com/WiseLibs/better-sqlite3/releases/download/v12.11.1/better-sqlite3-v12.11.1-electron-v146-linux-x64.tar.gz'
    
'koffi-linux-x64-3.2.0.tgz::https://registry.npmjs.org/@koromix/koffi-linux-x64/-/koffi-linux-x64-3.2.0.tgz'
    
'sharp-linux-x64-0.35.2.tgz::https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.2.tgz'
    
'sharp-libvips-linux-x64-1.3.1.tgz::https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.1.tgz'
    
'canvas-linux-x64-gnu-1.0.8.tgz::https://registry.npmjs.org/@napi-rs/canvas-linux-x64-gnu/-/canvas-linux-x64-gnu-1.0.8.tgz'
    
'wecom-cli-linux-x64-1.1.0.tgz::https://registry.npmjs.org/@wecom/cli-linux-x64/-/cli-linux-x64-1.1.0.tgz'
    
'ffmpeg-linux-x64-4.1.0.tgz::https://registry.npmjs.org/@ffmpeg-installer/linux-x64/-/linux-x64-4.1.0.tgz'
    
'agent-browser-0.38.1.tgz::https://registry.npmjs.org/agent-browser/-/agent-browser-0.38.1.tgz'
    
'catpaw-cli-linux-x64-1.2.0-beta.19::https://s3plus.meituan.net/mcopilot-pub/cli/v1.2.0-beta.19/catpaw-cli-linux-x64'
    
'convert.sh'
    
'repack-asar.js'
    
'patch-skill-manifests.js'
    
'catpaw.sh'
    
'catpaw-overseas.desktop'
    
'catpaw-overseas-16.png'
    
'catpaw-overseas-24.png'
    
'catpaw-overseas-32.png'
    
'catpaw-overseas-48.png'
    
'catpaw-overseas-64.png'
    
'catpaw-overseas-128.png'
    
'catpaw-overseas-256.png'
    
'catpaw-overseas-512.png'
    
'DISCLAIMER'
    
'LICENSE.port-scripts'
    
      65)
    
      66sha256sums=(
    
'61892d392534e429113ad65958f011cb25c635dcdbe02f85fe7cec2bdb7fb2b0'
    
'1e0b2a6d59bb8836858a24dec454c36e15a904dd1000a1053c8e36ecc44333bc'
    
'b586bf9cc6352053f9e075ed06a160a42653971742fd1746e8951e6942d55879'
    
'783130984963db7ba9cbd01089eaf2c2efb055c7c1693c943174b967b3050cb8'
    
'506191be3ee7bd190a8834dcdc1b3bc70aab50608deccc711935aa007239cabd'
    
'c7517f19083ddcb05f276904680eb2b11a6b5ecab778b8e4e5685a6d645b3f60'
    
'b10455d15a977c0cd17a1cb0eb679e03d939f8ef8d4302eb33e1f78dacc71f82'
    
'19af5978088739b8baf861a95ab4a1feb69a2d30830ced707c37920591046a87'
    
'f65e05feb1174937bd67b5ddb7a70d5eed314989d2bc8637e1594e1623c4a00f'
    
'e2021aeed80de4f15212525e30565756aaae790e68e3229df6d1345f43803221'
    
'c7f6cecb66c5ca9db08b0dd6b4f77ea52a01c45357fdd8a80c1bf2fa8382b44e'
    
'347e7db22852b7718e99862a558ca57a271bc9c1810cdf23c212caeb0aa622e3'
    
'61b2c772f5945683f1b315f277ac25eafa98c34fb9eaddd31342c47451d35f38'
    
'05032e8d7f5197bda600d3557facb51c7799811eaf4965d9b2d4d084ec13557d'
    
'8da74fecd9b89a92876e72d663dad5e436c771c91bb051d99b2eb63a1d889516'
    
'b836abe532912ae6c3388dbe713952af293a3d005fc9e4d34d52f14da99dda71'
    
'89a7df4761ff335e4dd5367e4cf04cecb9ba4e2cc130a0220f798d188414dc6c'
    
'2bf84853274ce6b39f3c363d5ed00573ad5ea99796c362dbb2c9a5e2be669c9c'
    
'00301679279b349dd6e1965fd9843c71e8749a11fb25cd920411d237bbb2e80a'
    
'ef50b80ae1d55a5f48c94db21cf74c3543723af4e89f85eb9d80c0900b1efdf1'
    
'ffa303d2f54724e538f4696cc7e108d7b73c254e92250f1cd2a0ac583aee22a6'
    
'8b7c70e7c9381857ef57b06adfe3abbaef16abc1ddc1bfe33ad403db742f657f'
    
'c9e8109a3657b04261796d3882f29819853b63ce13ccc8f31feadb0d5ca3f2d1'
    
'55d10fdc731deb7c012cafa24c43ac4aaf5e3958fb83fcede776d1444c675658'
    
'75b5f65a5571b30f61217f854a04c73235f611af601b3d8e8048aa3032d2be57'
    
'f3cdc95dfb60e468645a14c0713f4938ac317e7d33934558ab1426beed5826e0'
    
'dcfeacb7dc6dc54a7cffad8e84cfbdaf143fdb872f8612eb55beb0e48fb6c8b4'
    
'25557e84be98d1479302c378f8aeed1256f396876059379ddb2d3dece3eb6fa1'
    
'261cf54b6425f4d7619d74c7c45016dbaa3114fd0059738a7be5edf8df57ca46'
    
'a07207a2ac154a2d7fe140ef7a0cc7a54304443c570ddc2c39e7c73a45bced6b'
    
'a46fd41f737c444854aa40d0c3808a50a5934ce5d338a4fe109b24ff95351aca'
    
'c1cbc22e34b5109d993beda70d5fa3c776a958a2fa3872d895f4668515671b31'
    
'315ac7033d47f8bb9c58fa42c1956b59d7654da7dc7b9790c3d5b4749538fe60'
    
      100)
    
      101
    
      102# convert.sh performs its own extraction, so keep the downloaded archives intact.
    
      103noextract=(
    
"catpaw-${pkgver}.dmg"
    
"electron-v${_electron}-linux-x64.zip"
    
"node-v${_electron}-headers.tar.gz"
    
"node-v${_node}-linux-x64.tar.gz"
    
"cpython-${_python}-linux-x64-install_only.tar.gz"
    
'node-pty-1.1.0.tgz'
    
'node-addon-api-7.1.1.tgz'
    
'bufferutil-4.1.0.tgz'
    
'utf-8-validate-6.0.6.tgz'
    
'better-sqlite3-v12.11.1-electron-v146-linux-x64.tar.gz'
    
'koffi-linux-x64-3.2.0.tgz'
    
'sharp-linux-x64-0.35.2.tgz'
    
'sharp-libvips-linux-x64-1.3.1.tgz'
    
'canvas-linux-x64-gnu-1.0.8.tgz'
    
'wecom-cli-linux-x64-1.1.0.tgz'
    
'ffmpeg-linux-x64-4.1.0.tgz'
    
'agent-browser-0.38.1.tgz'
    
'catpaw-cli-linux-x64-1.2.0-beta.19'
    
      122)
    
      123
    
      124build() {
    
export APP_DMG="$srcdir/catpaw-${pkgver}.dmg"
    
export ELECTRON_ZIP="$srcdir/electron-v${_electron}-linux-x64.zip"
    
export ELECTRON_HEADERS_TGZ="$srcdir/node-v${_electron}-headers.tar.gz"
    
export NODE_TARBALL="$srcdir/node-v${_node}-linux-x64.tar.gz"
    
export PYTHON_TARBALL="$srcdir/cpython-${_python}-linux-x64-install_only.tar.gz"
    
export NODE_PTY_TGZ="$srcdir/node-pty-1.1.0.tgz"
    
export NODE_ADDON_API_TGZ="$srcdir/node-addon-api-7.1.1.tgz"
    
export BUFFERUTIL_TGZ="$srcdir/bufferutil-4.1.0.tgz"
    
export UTF8_VALIDATE_TGZ="$srcdir/utf-8-validate-6.0.6.tgz"
    
export BETTER_SQLITE3_TGZ="$srcdir/better-sqlite3-v12.11.1-electron-v146-linux-x64.tar.gz"
    
export KOFFI_TGZ="$srcdir/koffi-linux-x64-3.2.0.tgz"
    
export SHARP_TGZ="$srcdir/sharp-linux-x64-0.35.2.tgz"
    
export SHARP_LIBVIPS_TGZ="$srcdir/sharp-libvips-linux-x64-1.3.1.tgz"
    
export CANVAS_TGZ="$srcdir/canvas-linux-x64-gnu-1.0.8.tgz"
    
export WECOM_TGZ="$srcdir/wecom-cli-linux-x64-1.1.0.tgz"
    
export FFMPEG_LINUX_TGZ="$srcdir/ffmpeg-linux-x64-4.1.0.tgz"
    
export CATPAW_CLI_BIN="$srcdir/catpaw-cli-linux-x64-1.2.0-beta.19"
    
export AGENT_BROWSER_TGZ="$srcdir/agent-browser-0.38.1.tgz"
    
export WORK_DIR="$srcdir/build-work"
    
export OUT_DIR="$srcdir/app-out"
    
export ELECTRON_VER="$_electron"
    
export NODE_VER="$_node"
    
export PYTHON_VER="$_python"
    
export APP_NAME="catpaw"
    
export APP_ID="com.catx.catpaw.overseas"
    
export DISPLAY_NAME="CatPaw"
    
      151
    
bash "$srcdir/convert.sh"
    
      153}
    
      154
    
      155package() {
    
install -dm755 "$pkgdir/opt"
    
cp -a "$srcdir/app-out" "$pkgdir/opt/catpaw"
    
      158
    
install -Dm755 "$srcdir/catpaw.sh" "$pkgdir/usr/bin/catpaw"
    
install -Dm644 "$srcdir/catpaw-overseas.desktop" \
    
  "$pkgdir/usr/share/applications/catpaw-overseas.desktop"
    
      162
    
local size
    
for size in 16 24 32 48 64 128 256 512; do
    
  install -Dm644 "$srcdir/catpaw-overseas-${size}.png" \
    
    "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/catpaw-overseas.png"
    
done
    
      168
    
install -Dm644 "$srcdir/app-out/LICENSE" \
    
  "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron"
    
install -Dm644 "$srcdir/DISCLAIMER" "$pkgdir/usr/share/licenses/$pkgname/DISCLAIMER"
    
install -Dm644 "$srcdir/LICENSE.port-scripts" \
    
  "$pkgdir/usr/share/licenses/$pkgname/LICENSE.port-scripts"
    
      174}
    
      175

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-03 14:06:57	Medium	3
2026-11-03 14:04:44	Medium	3