com.yunkanpan.numnode

maintainer KAAAsS · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary tarball from cdn.yunkanpan.com (the vendor's own CDN) and installs it directly to /opt/yunkanpan with chmod 777. The host appears to be the official vendor CDN for yunkanpan.com, so this is not a random personal host — it is the upstream vendor distributing their own proprietary closed-source application as a binary blob. However, the concerns are real: (1) a prebuilt binary from a CDN with no reproducibility, (2) chmod 777 on the entire installation directory is a security smell, (3) the application is a proprietary Chinese stock-market viewer ('云看盘') distributed as a closed binary with no source, and (4) the CDN could be compromised or the binary swapped without notice. The sha512sums provide some integrity protection at download time. This is a classic medium-risk pattern: a legitimate-looking vendor binary from a non-auditable source installed as an executable. Not clearly malicious, but a genuine supply-chain concern due to the opaque binary blob from a CDN with no source transparency.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("http://cdn.yunkanpan.com/static/download/com.yunkanpan.numnode_${pkgver}_amd64_manjaro.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary tarball from cdn.yunkanpan.com (the vendor's own CDN) and installs it directly to /opt/yunkanpan with chmod 777. The host appears to be the official vendor CDN for yunkanpan.com, so this is not a random personal host — it is the upstream vendor distributing their own proprietary closed-source application as a binary blob. However, the concerns are real: (1) a prebuilt binary from a CDN with no reproducibility, (2) chmod 777 on the entire installation directory is a security smell, (3) the application is a proprietary Chinese stock-market viewer ('云看盘') distributed as a closed binary with no source, and (4) the CDN could be compromised or the binary swapped without notice. The sha512sums provide some integrity protection at download time. This is a classic medium-risk pattern: a legitimate-looking vendor binary from a non-auditable source installed as an executable. Not clearly malicious, but a genuine supply-chain concern due to the opaque binary blob from a CDN with no source transparency.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: KAAAsS <admin [at] kaaass dot net>
    
      2# Maintainer: zhullyb <zhullyb [at] outlook dot com>
    
      3
    
      4pkgname=com.yunkanpan.numnode
    
      5pkgver=1.2.3.1
    
      6pkgrel=2
    
      7pkgdesc="欢迎使用云看盘软件"
    
      8arch=("x86_64")
    
      9install=
    
      10url="http://yunkanpan.com/"
    
      11license=("custom")
    
      12depends=()
    
      13optdepends=('ttf-ms-win10: Microsft Fonts recommended'
    
      14            'ttf-ms-fonts: Microsft Fonts recommended')
    
      15options=(!strip)
    
      16provides=('yunkanpan')
    
      17source=("http://cdn.yunkanpan.com/static/download/com.yunkanpan.numnode_${pkgver}_amd64_manjaro.tar.gz"
    
      18        "start.sh"
    
      19        "com.yunkanpan.numnode.desktop"
    
      20        "com.yunkanpan.numnode.svg")
    
      21sha512sums=(
    
      22    91ed4c356f85c2bd9899a0c668f0e4437d8ef4fbdfd0d9bfbeb08c8ea41614489a185e89af39f85a777546612185126f4c9b3af83628a7f149399c454e61bb70
    
      23    0a5e2368c8f81e05442e371e0d36e00cb2c709f46b5cf70542d548d083a8d37b684c55734ae852e7954882041f9cacd8f49dfbb0579cc6f13eb2165cdf1f2058
    
      24    7271acb7e31994557dafd3094b806fbccccfdbcb61824766b48d79392ba4886079f3c91b76b6db6ea4d0c383dc09d0d8b9f4264a9c6732cce1916ba3a58f5ba5
    
      25    8a6bedb185606de86d84d126aba4126dc965ad7aec746c3231a83b7e31aef80c94695740c399790f33cec750aafec56ee18e66cb12794c698d76e8ed3530ebb1
    
      26)
    
      27
    
      28package(){
    
      29    cd ${srcdir}
    
      30    mkdir -p ${pkgdir}/usr/bin
    
      31    mkdir -p ${pkgdir}/usr/share/{applications,icons}
    
      32    mv com.yunkanpan.numnode.desktop ${pkgdir}/usr/share/applications
    
      33    mv com.yunkanpan.numnode.svg ${pkgdir}/usr/share/icons
    
      34    
    
      35    mkdir -p ${pkgdir}/opt/yunkanpan
    
      36    rm -rf com.yunkanpan.numnode_${pkgver}_amd64_manjaro/logo
    
      37    mv com.yunkanpan.numnode_${pkgver}_amd64_manjaro/* ${pkgdir}/opt/yunkanpan
    
      38
    
      39    mv ${srcdir}/start.sh ${pkgdir}/opt/yunkanpan/
    
      40    chmod a+x ${pkgdir}/opt/yunkanpan/start.sh
    
      41    mkdir -p ${pkgdir}/usr/bin
    
      42    ln -s /opt/yunkanpan/start.sh ${pkgdir}/usr/bin/yunkanpan
    
      43    
    
      44    rm ${pkgdir}/opt/yunkanpan/libstdc++.so.6
    
      45    ln -s /usr/lib/libstdc++.so.6 ${pkgdir}/opt/yunkanpan/libstdc++.so.6
    
      46    
    
      47    chmod -R 777 ${pkgdir}/opt/yunkanpan
    
      48}
    
      49 
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2