connect-me-desktop-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:15 source=("$_pkgname-$pkgver::https://store.connectme.io/app/$_zipfile" "ConnectMeDesktop.desktop" "ConnectMeDesktop")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt NW.js application (a zip containing .nw app files and an nwjs runtime) from store.connectme.io, which is the vendor's own distribution host for this proprietary desktop application. The binary is installed to /opt and executed directly. The concerns are: (1) it's a prebuilt binary from a non-standard host with only an MD5 checksum (MD5 is cryptographically weak and provides limited integrity protection); (2) NW.js bundles include a full Chromium/Node.js runtime, meaning the package installs a significant amount of executable code; (3) there is no GPG signature verification. However, store.connectme.io appears to be the official vendor distribution channel for this product (matching the url= field), so this is consistent with a legitimate proprietary software AUR package pattern (-bin suffix). The risk is real but typical for binary AUR packages: if the vendor host is compromised or the file is swapped, the weak MD5 checksum offers minimal protection. This is a genuine medium-severity supply-chain concern, not a false positive, but also not evidence of active malice.