clickup-desktop

MEDIUM
maintainer edoaurahman 2 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads a prebuilt AppImage from a non-whitelisted host (desktop.clickup.com) with a SKIP'd checksum, representing a supply-chain risk if the host were compromised or subverted.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:12 "https://desktop.clickup.com/linux" \
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-whitelisted host (desktop.clickup.com) with a SKIP'd checksum, representing a supply-chain risk if the host were compromised or subverted.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: edoaurahman <edoaurahman@gmail.com>
2
3pkgname=clickup-desktop
4pkgver=3.5.230
5pkgrel=1
6
7pkgver() {
8 local response=$(curl -s -L -D - \
9 -m 5 \
10 --max-filesize 1M \
11 --range 0-1024 \
12 "https://desktop.clickup.com/linux" \
13 -o /dev/null)
14
15 if [[ $response =~ filename=\"desktop-([0-9]+\.[0-9]+\.[0-9]+) ]]; then
16 echo "${BASH_REMATCH[1]}"
17 else
18 echo "$pkgver"
19 fi
20}
21pkgdesc="Desktop app for clickup.com"
22arch=('x86_64')
23url="https://clickup.com"
24license=('CustomLicense')
25provides=('clickup')
26conflicts=('clickup')
27depends=(
28 'alsa-lib'
29 'dbus-glib'
30 'gtk3'
31 'libdbusmenu-gtk3'
32 'libindicator-gtk3'
33 'libsecret'
34 'libxkbfile'
35 'nss'
36)
37makedepends=('sed')
38options=('!strip')
39
40_filename="clickup-desktop.AppImage"
41
42source=("${_filename}::https://desktop.clickup.com/linux")
43
44sha256sums=('SKIP')
45
46prepare() {
47 rm -rf squashfs-root
48 chmod +x $_filename
49 ./$_filename --appimage-extract
50
51 find squashfs-root -type d -exec chmod a+rx {} \;
52}
53
54package() {
55 cd "${srcdir}/squashfs-root"
56
57 install -dm0755 "${pkgdir}/usr/bin"
58 ln -s /opt/clickup/desktop "${pkgdir}/usr/bin/clickup"
59
60 install -Dm0644 desktop.desktop -T "${pkgdir}/usr/share/applications/ClickUp.desktop"
61 sed -i \
62 -e "s|^Exec=.\+|Exec=/usr/bin/clickup %U|" \
63 -e "s|^Icon=.\+|Icon=ClickUp|" \
64 "${pkgdir}/usr/share/applications/ClickUp.desktop"
65
66 install -Dm0644 LICENSE.electron.txt -t "${pkgdir}/usr/share/licenses/${pkgname}/"
67 install -Dm0644 LICENSES.chromium.html -t "${pkgdir}/usr/share/licenses/${pkgname}/"
68
69 icons=(512x512 256x256 128x128 64x64 48x48 32x32 16x16)
70
71 for size in "${icons[@]}"; do
72 install -Dm0644 usr/share/icons/hicolor/${size}/apps/desktop.png -T "${pkgdir}/usr/share/icons/hicolor/${size}/apps/ClickUp.png"
73 done
74
75 cd "${srcdir}"
76 install -dm0755 "${pkgdir}/opt"
77 mv squashfs-root "${pkgdir}/opt/clickup"
78 chmod 755 "${pkgdir}/opt/clickup"
79 chmod a+rX "${pkgdir}/opt/clickup/"
80
81 rm -r "${pkgdir}/opt/clickup/usr/share/"
82 rm "${pkgdir}/opt/clickup/AppRun" "${pkgdir}/opt/clickup/desktop.desktop"
83 rm "${pkgdir}/opt/clickup/desktop.png" "${pkgdir}/opt/clickup/.DirIcon"
84 rm "${pkgdir}/opt/clickup/LICENSE.electron.txt" "${pkgdir}/opt/clickup/LICENSES.chromium.html"
85}
86

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Medium 2
2026-09-16 00:03:17 Medium 2
2026-09-15 00:25:31 Medium 2
2026-09-14 00:27:57 Medium 2
2026-09-13 00:19:54 Medium 2
2026-09-12 00:25:17 Medium 2
2026-09-11 00:19:22 Medium 2
2026-09-10 00:22:44 Medium 2
2026-09-09 00:04:09 Medium 2
2026-09-08 00:18:08 Medium 2
2026-09-07 00:30:15 Medium 2
2026-09-06 00:17:06 Medium 2
2026-09-05 00:16:27 Medium 2
2026-09-04 00:03:13 Medium 2
2026-09-03 00:15:47 Medium 2
2026-09-02 00:02:31 Medium 2
2026-09-01 00:11:19 Medium 2
2026-08-31 00:19:57 Medium 2
2026-08-30 00:04:14 Medium 2
2026-08-29 00:29:17 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion