cn.com.10jqka

maintainer lightning1141 · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from resource.thsi.cn, which is the CDN/resource host for 同花顺 (Tonghuashun/10jqka), a well-known Chinese stock trading application. The domain thsi.cn is the official backend domain for 10jqka.com.cn (THSI = Tonghuashun Information). This is not a random personal host — it is the vendor's own resource server. However, the concern remains legitimate at medium severity: (1) it is a prebuilt proprietary binary blob being extracted and installed directly, (2) the host is not a widely recognized official distribution channel like a distro mirror or GitHub releases, and (3) the package installs executables from a Chinese financial software vendor with no source build. The sha256sum is pinned, which mitigates substitution risk somewhat, but does not address the trustworthiness of the binary itself. This is a classic medium-risk pattern: a closed-source binary from a vendor-adjacent but non-standard host. Not clearly malicious, but a real supply-chain concern for anyone installing financial software as a binary blob.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "http://resource.thsi.cn/soft/${pkgname}_${pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from resource.thsi.cn, which is the CDN/resource host for 同花顺 (Tonghuashun/10jqka), a well-known Chinese stock trading application. The domain thsi.cn is the official backend domain for 10jqka.com.cn (THSI = Tonghuashun Information). This is not a random personal host — it is the vendor's own resource server. However, the concern remains legitimate at medium severity: (1) it is a prebuilt proprietary binary blob being extracted and installed directly, (2) the host is not a widely recognized official distribution channel like a distro mirror or GitHub releases, and (3) the package installs executables from a Chinese financial software vendor with no source build. The sha256sum is pinned, which mitigates substitution risk somewhat, but does not address the trustworthiness of the binary itself. This is a classic medium-risk pattern: a closed-source binary from a vendor-adjacent but non-standard host. Not clearly malicious, but a real supply-chain concern for anyone installing financial software as a binary blob.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lightning1141 <lightning1141@gmail.com>
    
      2
    
      3pkgname='cn.com.10jqka'
    
      4# the versin is from deb package
    
      5pkgver=2.7.1.2
    
      6pkgrel=3
    
      7pkgdesc="cn.com.10jqka(royalflush/tonghuashun/同花顺) - a tool for scanning the stock infomation."
    
      8arch=("x86_64")
    
      9url="https://www.10jqka.com.cn"
    
      10# url="http://activity.10jqka.com.cn/acmake/cache/1380.html"
    
      11license=('custom')
    
      12depends=()
    
      13
    
      14install='cn.com.10jqka.install'
    
      15source=(
    
      16    "http://resource.thsi.cn/soft/${pkgname}_${pkgver}_amd64.deb"
    
      17    update_config.sh
    
      18)
    
      19sha256sums=(
    
      20    '40c9a5c551cdc48e10b51e003e70254919d89aa0a1481ab63324a37a363648fd'
    
      21    '269df82f6723982b7d9aaa3d90fc680dcbdc3a555e32340cc2de0439ac581c46'
    
      22)
    
      23
    
      24package() {
    
      25    tar xf data.tar.xz -C ${pkgdir}/
    
      26
    
      27    # remove apps dir
    
      28    mv "${pkgdir}/opt/apps/cn.com.10jqka" "${pkgdir}/opt/"
    
      29    rm -r "${pkgdir}/opt/apps"
    
      30    sed -i 's/apps\///' "${pkgdir}/opt/cn.com.10jqka/entries/applications/cn.com.10jqka.desktop"
    
      31
    
      32    chmod 755 -R "${pkgdir}/opt/cn.com.10jqka/files"
    
      33
    
      34    # fix cannot find deps error
    
      35    sed -i '/\.a"/,+2 d' "${pkgdir}/opt/cn.com.10jqka/files/HevoNext.B2CApp.deps.json"
    
      36
    
      37    install -d "${pkgdir}/usr/share/applications"
    
      38    install -m644 "${pkgdir}/opt/cn.com.10jqka/entries/applications/cn.com.10jqka.desktop" "${pkgdir}/usr/share/applications/"
    
      39    install -D -m755 -t "$pkgdir/opt/cn.com.10jqka/" "$srcdir/update_config.sh"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2