claude-desktop-native

maintainer dcelasun · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads the official Claude Desktop Windows installer from Anthropic's Google Cloud Storage bucket (osprey-downloads-c02f6a0d-347c-492b-a752-3e0651722e97 is Anthropic's official distribution bucket), which has a proper sha256 checksum. The git source (patchy-cnb) is SKIP'd but is a known open-source project for Linux Claude compatibility. The two `npx asar` calls use the locally installed `asar` npm package (not fetching remote code at runtime beyond what npm install already fetched), so they are not truly 'remote execution'. The main concern is the SKIP'd checksum on the git source and the fact that a Rust-compiled native .node binary from patchy-cnb replaces claude-native-binding.node — this compiled binary runs inside the Electron app with full user privileges and its integrity is not pinned. This is a genuine medium-severity supply-chain concern: an unverified compiled native module replaces a core binding in a proprietary app. However, there is no obfuscation, no exfiltration, and the overall pattern matches known legitimate Linux Claude Desktop packaging efforts. The severity remains medium due to the unpinned compiled native module substitution.

Triggered rules

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:59 npx asar extract app.asar app.asar.contents
PKGBUILD:82 npx asar pack app.asar.contents app.asar

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("Claude-Setup-x64-${pkgver}-${pkgrel}.exe::https://storage.googleapis.com/osprey-downloads-c02f6a0d-347c-492b-a752-3e0651722e97/nest-win-x64/Claude-Setup-x64.exe"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads the official Claude Desktop Windows installer from Anthropic's Google Cloud Storage bucket (osprey-downloads-c02f6a0d-347c-492b-a752-3e0651722e97 is Anthropic's official distribution bucket), which has a proper sha256 checksum. The git source (patchy-cnb) is SKIP'd but is a known open-source project for Linux Claude compatibility. The two `npx asar` calls use the locally installed `asar` npm package (not fetching remote code at runtime beyond what npm install already fetched), so they are not truly 'remote execution'. The main concern is the SKIP'd checksum on the git source and the fact that a Rust-compiled native .node binary from patchy-cnb replaces claude-native-binding.node — this compiled binary runs inside the Electron app with full user privileges and its integrity is not pinned. This is a genuine medium-severity supply-chain concern: an unverified compiled native module replaces a core binding in a proprietary app. However, there is no obfuscation, no exfiltration, and the overall pattern matches known legitimate Linux Claude Desktop packaging efforts. The severity remains medium due to the unpinned compiled native module substitution.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: AstroSteveO <stevengmjr at gmail dot com>
    
      2
    
      3pkgname=claude-desktop-native
    
      4pkgver=0.14.10
    
      5pkgrel=2
    
      6pkgdesc="Unofficial Claude Desktop for Linux"
    
      7arch=('x86_64')
    
      8url="https://github.com/jkoelker/claude-desktop-native"
    
      9license=('MIT' 'Apache')
    
      10depends=('electron')
    
      11makedepends=('p7zip' 'npm' 'nodejs' 'rust' 'cargo' 'imagemagick' 'icoutils' 'tar')
    
      12optdepends=('docker: for running MCP servers')
    
      13source=("Claude-Setup-x64-${pkgver}-${pkgrel}.exe::https://storage.googleapis.com/osprey-downloads-c02f6a0d-347c-492b-a752-3e0651722e97/nest-win-x64/Claude-Setup-x64.exe"
    
      14  "patchy-cnb::git+https://github.com/k3d3/claude-desktop-linux-flake.git")
    
      15sha256sums=('4a7fe5bcc95f29dedbfeeb45bc2c6b916343253ba0e0e392038968f5857c6aa9'
    
      16            'SKIP')
    
      17
    
      18prepare() {
    
      19  cd "${srcdir}"
    
      20
    
      21  # Extract installer exe and nupkg
    
      22  7z x -y "Claude-Setup-x64-${pkgver}-${pkgrel}.exe"
    
      23  7z x -y "AnthropicClaude-${pkgver}-full.nupkg"
    
      24
    
      25  # Verify version matches what's in the nuspec file
    
      26  if [ -f "AnthropicClaude.nuspec" ]; then
    
      27    NUSPEC_VERSION=$(grep -oP '<version>\K[^<]+' "AnthropicClaude.nuspec")
    
      28    if [ "$NUSPEC_VERSION" != "$pkgver" ]; then
    
      29      echo "WARNING: PKGBUILD version ($pkgver) does not match nuspec version ($NUSPEC_VERSION)"
    
      30      echo "Please update pkgver in PKGBUILD to: $NUSPEC_VERSION"
    
      31    fi
    
      32  fi
    
      33
    
      34  # Extract icons from claude.exe
    
      35  wrestool -x -t 14 lib/net45/claude.exe -o claude.ico
    
      36  icotool -x claude.ico
    
      37
    
      38  mkdir -p icons/hicolor
    
      39  for size in 16 24 32 48 64 256; do
    
      40    mkdir -p "icons/hicolor/${size}x${size}/apps"
    
      41    install -Dm 644 claude_*"${size}x${size}x32.png" \
    
      42      "icons/hicolor/${size}x${size}/apps/claude.png"
    
      43  done
    
      44}
    
      45
    
      46build() {
    
      47  # Build patchy-cnb (assuming patchy-cnb folder exists at same level as PKGBUILD)
    
      48  cd "${srcdir}/patchy-cnb/patchy-cnb"
    
      49  npm install
    
      50  npm run build
    
      51  cd "${srcdir}"
    
      52
    
      53  # Process app.asar files
    
      54  mkdir -p electron-app
    
      55  cp "lib/net45/resources/app.asar" electron-app/
    
      56  cp -r "lib/net45/resources/app.asar.unpacked" electron-app/
    
      57
    
      58  cd electron-app
    
      59  npx asar extract app.asar app.asar.contents
    
      60  # Fix resource paths - handle different variable names for app object
    
      61  sed -i 's|return[[:space:]]\+[a-zA-Z_][a-zA-Z0-9_]*\.app\.isPackaged[[:space:]]*?[^:]*:[[:space:]]*[a-zA-Z_][a-zA-Z0-9_]*\.resolve([^,]*,[[:space:]]*"\.\.","\.\.","resources")|return "/usr/lib/'"${pkgname}"'/resources"|g' app.asar.contents/.vite/build/index*.js
    
      62  # Fix i18n resource paths specifically
    
      63  sed -i 's|return[[:space:]]\+[a-zA-Z_][a-zA-Z0-9_]*\.app\.isPackaged[[:space:]]*?[^:]*:[[:space:]]*[a-zA-Z_][a-zA-Z0-9_]*\.resolve([^,]*,[[:space:]]*"\.\.","\.\.","resources","i18n")|return "/usr/lib/'"${pkgname}"'/resources"|g' app.asar.contents/.vite/build/index*.js
    
      64  # fix negation operator to show menubar
    
      65  sed -i -E 's/if\(!([a-zA-Z]+)[[:space:]]*&&[[:space:]]*([a-zA-Z]+)\)/if(\1 \&\& \2)/g' app.asar.contents/.vite/renderer/main_window/assets/MainWindowPage-*.js
    
      66
    
      67  # Replace native bindings with patchy-cnb
    
      68  pwd
    
      69  local PATCHY_CNB_NODE=$(find ../patchy-cnb/patchy-cnb -name "patchy-cnb.*.node")
    
      70  cp "${PATCHY_CNB_NODE}" app.asar.contents/node_modules/claude-native/claude-native-binding.node
    
      71  cp "${PATCHY_CNB_NODE}" app.asar.unpacked/node_modules/claude-native/claude-native-binding.node
    
      72
    
      73  # Add Tray icons to app resources
    
      74  mkdir -p app.asar.contents/resources
    
      75  cp ../lib/net45/resources/Tray* app.asar.contents/resources/
    
      76
    
      77  # Copy i18n json files
    
      78  mkdir -p app.asar.contents/resources/i18n
    
      79  cp ../lib/net45/resources/*.json app.asar.contents/resources/i18n/
    
      80
    
      81  # Repackage app.asar
    
      82  npx asar pack app.asar.contents app.asar
    
      83}
    
      84
    
      85package() {
    
      86  cd "${srcdir}"
    
      87
    
      88  # Install app files
    
      89  install -d "${pkgdir}/usr/lib/${pkgname}"
    
      90  cp -r electron-app/app.asar "${pkgdir}/usr/lib/${pkgname}/"
    
      91  cp -r electron-app/app.asar.unpacked "${pkgdir}/usr/lib/${pkgname}/"
    
      92
    
      93  # Install resources directory with tray icons
    
      94  install -d "${pkgdir}/usr/lib/${pkgname}/resources"
    
      95  cp electron-app/app.asar.contents/resources/Tray* "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      96
    
      97  # Copy language JSON files to resources directory
    
      98  cp lib/net45/resources/*.json "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      99
    
      100  # Install icons
    
      101  install -d "${pkgdir}/usr/share/icons"
    
      102  cp -r icons/* "${pkgdir}/usr/share/icons/"
    
      103
    
      104  # Create desktop file
    
      105  install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
    
      106[Desktop Entry]
    
      107Name=Claude
    
      108GenericName=Claude Desktop
    
      109Exec=${pkgname} %u
    
      110Icon=claude
    
      111Type=Application
    
      112Terminal=false
    
      113Categories=Office;Utility;
    
      114MimeType=x-scheme-handler/claude;
    
      115StartupWMClass=Claude
    
      116EOF
    
      117
    
      118  # Create launcher script
    
      119  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}" <<EOF
    
      120#!/bin/sh
    
      121exec electron /usr/lib/${pkgname}/app.asar --gtk-version=3 "\$@"
    
      122EOF
    
      123}
    
      124

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3