cmd-markdown

maintainer witt.9099 · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt x86_64/i686 binaries (a NW.js/Electron-based Markdown editor) from client.zybuluo.com, which is the vendor's own download subdomain (zybuluo.com is the official site for Cmd Markdown). The sha256sums are pinned, which mitigates tampering in transit. However, the host is not a well-known distribution channel (e.g., GitHub releases), the binaries are closed-source and prebuilt, and the package installs an executable binary directly to /opt. The supply-chain risk is real but not elevated beyond a typical proprietary prebuilt package: if the vendor's server is compromised or the vendor is malicious, users get arbitrary code execution. The sha256 pinning provides some protection against in-transit substitution but not against the vendor shipping malicious binaries. This is a standard medium-risk pattern for prebuilt proprietary software from a vendor-controlled but non-mainstream host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("${pkgname}_x86_64_${pkgver}.zip::https://client.zybuluo.com/cmd_linux64_v3.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads prebuilt x86_64/i686 binaries (a NW.js/Electron-based Markdown editor) from client.zybuluo.com, which is the vendor's own download subdomain (zybuluo.com is the official site for Cmd Markdown). The sha256sums are pinned, which mitigates tampering in transit. However, the host is not a well-known distribution channel (e.g., GitHub releases), the binaries are closed-source and prebuilt, and the package installs an executable binary directly to /opt. The supply-chain risk is real but not elevated beyond a typical proprietary prebuilt package: if the vendor's server is compromised or the vendor is malicious, users get arbitrary code execution. The sha256 pinning provides some protection against in-transit substitution but not against the vendor shipping malicious binaries. This is a standard medium-risk pattern for prebuilt proprietary software from a vendor-controlled but non-mainstream host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: witt <1989161762 at qq dot com>
    
      2
    
      3pkgname=cmd-markdown
    
      4pkgver=3.0
    
      5pkgrel=1
    
      6pkgdesc='An enhanced Markdown editor with MathJax, flowchart & sequence-diagram support'
    
      7arch=('x86_64' 'i686')
    
      8url='https://www.zybuluo.com/cmd'
    
      9license=('custom')
    
      10depends=('nss' 'gconf' 'libnotify' 'gtk2' 'alsa-lib' 'libxtst' 'libudev0-shim' 'hicolor-icon-theme')
    
      11DLAGENTS=("https::/usr/bin/wget --user-agent=Mozilla --referer=https://zybuluo.com -O %o %u")
    
      12source_x86_64=("${pkgname}_x86_64_${pkgver}.zip::https://client.zybuluo.com/cmd_linux64_v3.zip")
    
      13source_i686=("${pkgname}_i686_${pkgver}.zip::https://client.zybuluo.com/cmd_linux32_v3.zip")
    
      14options=('!strip')
    
      15sha256sums_x86_64=('ab1cf279d9edf10421771afb6e7665b6ebcf712955e9bd24be878774375677ef')
    
      16sha256sums_i686=('5ca01813eaed9ae3e162b03c8fc843b70c57f3a38335a005d6eed1366dcca9b3')
    
      17
    
      18prepare(){
    
      19    [ -d "${srcdir}/${pkgname/-/_}_linux64" ] && mv "${srcdir}/${pkgname/-/_}_linux64" "${srcdir}/${pkgname}"
    
      20    [ -d "${srcdir}/${pkgname/-/_}_linux32" ] && mv "${srcdir}/${pkgname/-/_}_linux32" "${srcdir}/${pkgname}"
    
      21
    
      22    {
    
      23        echo "Icon=${pkgname}"
    
      24        echo "Terminal=false"
    
      25        echo "Categories=Office;Applications;TextEditor;"
    
      26        echo "Comment=An enhanced Markdown editor"
    
      27        echo "Encoding=UTF-8"
    
      28    } >> "${srcdir}/${pkgname}/Cmd Markdown.desktop"
    
      29
    
      30    sed -i "s/Exec=Cmd Markdown/Exec=${pkgname}/" "${srcdir}/${pkgname}/Cmd Markdown.desktop"
    
      31}
    
      32
    
      33package(){
    
      34    install -dm755 "${pkgdir}/usr/bin"
    
      35    install -Dm644 "${srcdir}/${pkgname}/Cmd Markdown.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      36    rm "${srcdir}/${pkgname}/Cmd Markdown.desktop"
    
      37
    
      38    # icons
    
      39    find "${srcdir}/${pkgname}/package.nw/black_icons" -type f -name "icon_*x*.png" | while read -r icon_file; do
    
      40        # 提取文件名
    
      41        filename=$(basename "${icon_file}")
    
      42
    
      43        size="${filename##icon_}"
    
      44        size="${size/.png/}"
    
      45
    
      46        install -Dm644 "${icon_file}" "${pkgdir}/usr/share/icons/hicolor/${size}/apps/${pkgname}.png"
    
      47    done
    
      48
    
      49    # binary
    
      50    install -Dm755 "${srcdir}/${pkgname}/Cmd Markdown" "${pkgdir}/opt/${pkgname}/Cmd Markdown"
    
      51    ln -s "/opt/${pkgname}/Cmd Markdown" "${pkgdir}/usr/bin/${pkgname}"
    
      52    rm "${srcdir}/${pkgname}/Cmd Markdown"
    
      53
    
      54    install -Dm755 "${srcdir}/${pkgname}/chrome_crashpad_handler" "${pkgdir}/opt/${pkgname}/chrome_crashpad_handler"
    
      55    rm "${srcdir}/${pkgname}/chrome_crashpad_handler"
    
      56
    
      57    find "${pkgname}/" -type f -exec install -Dm644 {} "${pkgdir}/opt/{}" \;
    
      58}
    
      59
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2