corplink-bin

maintainer lance6716 · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from cdn.isealsuite.com, which is not ByteDance's/Volcengine's official domain (volcengine.com or bytedance.com). The package installs a closed-source, pre-compiled binary (corplink) directly into /usr/bin and registers a systemd service, giving it persistent execution at the system level. While isealsuite.com may be a legitimate CDN used by the vendor for distribution, it is not verifiable as an official Bytedance/Volcengine host, creating a genuine supply-chain risk: if the CDN host is compromised or is a third-party repackager, users would execute arbitrary untrusted binaries with system-level access. The sha512sum provides integrity checking against the specific artifact but does not establish trust in the source host. This is a real medium-severity concern — an executed binary from an unofficial/unverifiable host — not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://cdn.isealsuite.com/linux/FeiLian_Linux_amd64_v${pkgver}_$_pkgrel.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from cdn.isealsuite.com, which is not ByteDance's/Volcengine's official domain (volcengine.com or bytedance.com). The package installs a closed-source, pre-compiled binary (corplink) directly into /usr/bin and registers a systemd service, giving it persistent execution at the system level. While isealsuite.com may be a legitimate CDN used by the vendor for distribution, it is not verifiable as an official Bytedance/Volcengine host, creating a genuine supply-chain risk: if the CDN host is compromised or is a third-party repackager, users would execute arbitrary untrusted binaries with system-level access. The sha512sum provides integrity checking against the specific artifact but does not establish trust in the source host. This is a real medium-severity concern — an executed binary from an unofficial/unverifiable host — not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jat <chat@jat.email>
    
      2
    
      3pkgname=corplink-bin
    
      4pkgver=3.1.18
    
      5_pkgrel=r6560_8a2fab
    
      6pkgrel=2
    
      7pkgdesc="Linux client of Feilian (veCorpLink) from Bytedance."
    
      8arch=('x86_64')
    
      9url="https://www.volcengine.com/product/feilian"
    
      10license=('unknown')
    
      11depends=('gtk3' 'libxss' 'nss' 'dnsmasq' 'iw')
    
      12optdepends=('networkmanager: NetworkManager integration')
    
      13options=('!strip' '!emptydirs')
    
      14install=${pkgname}.install
    
      15source=("https://cdn.isealsuite.com/linux/FeiLian_Linux_amd64_v${pkgver}_$_pkgrel.deb")
    
      16sha512sums=('e6d2415ae8c972daeccdf3a43344284c7ba0a5fabbfe736d0c2f61463042b7871bb6f9bb94ac2f56b86cb0b6fe83fe6865c63222850ede790215f09ed70d7899')
    
      17
    
      18package() {
    
      19  # Extract package data
    
      20  tar xpvf "${srcdir}/data.tar.xz" --xattrs-include='*' --no-same-owner -C "${pkgdir}"
    
      21
    
      22  # Fix directory structure differences
    
      23  cd "${pkgdir}"
    
      24  mkdir -p usr/bin usr/lib/systemd/system
    
      25  ln -s /opt/apps/com.volcengine.feilian/files/corplink usr/bin/corplink
    
      26  mv "${pkgdir}"/opt/apps/com.volcengine.feilian/files/corplink.service usr/lib/systemd/system/corplink.service
    
      27
    
      28  rm -r usr/local
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2