corplink-bin

MEDIUM

maintainer lance6716 4 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb binary from a non-standard, third-party host (cdn.isealsuite.com) which is not affiliated with the official vendor (Bytedance/Volcengine), creating a supply-chain risk if the host is compromised or malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://cdn.isealsuite.com/linux/FeiLian_Linux_amd64_v${pkgver}_$_pkgrel.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-standard, third-party host (cdn.isealsuite.com) which is not affiliated with the official vendor (Bytedance/Volcengine), creating a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jat <chat@jat.email>
    
      2
    
      3pkgname=corplink-bin
    
      4pkgver=3.2.16
    
      5_pkgrel=r8362_0d182a
    
      6pkgrel=2
    
      7pkgdesc="Linux client of Feilian (veCorpLink) from Bytedance."
    
      8arch=('x86_64')
    
      9url="https://www.volcengine.com/product/feilian"
    
      10license=('unknown')
    
      11depends=('gtk3' 'libxss' 'nss' 'dnsmasq' 'iw' 'iproute2')
    
      12optdepends=('networkmanager: NetworkManager integration')
    
      13options=('!strip' '!emptydirs')
    
      14install=${pkgname}.install
    
      15source=("https://cdn.isealsuite.com/linux/FeiLian_Linux_amd64_v${pkgver}_$_pkgrel.deb")
    
      16sha512sums=('129731f371215d1ef2f15a7746c7bd16404e1e4ba287d5f238d1bc240e3b279214e3b15a6468d674b0127f533e03a31e496e1ed301701075ca4320a1c7016e1e')
    
      17
    
      18package() {
    
      19  # Extract package data
    
      20  tar xpvf "${srcdir}/data.tar.xz" --xattrs-include='*' --no-same-owner -C "${pkgdir}"
    
      21
    
      22  # Fix directory structure differences
    
      23  cd "${pkgdir}"
    
      24  mkdir -p usr/bin usr/lib/systemd/system
    
      25  ln -s /opt/apps/com.volcengine.feilian/files/corplink usr/bin/corplink
    
      26  mv "${pkgdir}"/opt/apps/com.volcengine.feilian/files/corplink.service usr/lib/systemd/system/corplink.service
    
      27
    
      28  # The upstream unit starts after network.target, which can be reached before
    
      29  # NetworkManager has brought up an interface and configured DNS.  Wait for
    
      30  # network-online and a default route so the client initializes its connection
    
      31  # only after the host has usable network connectivity.
    
      32  sed -i \
    
      33    -e 's/^After=network.target$/After=network-online.target/' \
    
      34    -e '/^Description=/a Wants=network-online.target' \
    
      35    -e '/^\[Service\]$/a ExecStartPre=/usr/bin/sh -c "until /usr/bin/ip route show default | /usr/bin/grep -q default; do /usr/bin/sleep 1; done"' \
    
      36    usr/lib/systemd/system/corplink.service
    
      37
    
      38  rm -r usr/local
    
      39}
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-09-09 00:04
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,19 +1,19 @@
 # Maintainer: Jat <chat@jat.email>
 
 pkgname=corplink-bin
-pkgver=3.1.18
-_pkgrel=r6560_8a2fab
+pkgver=3.2.16
+_pkgrel=r8362_0d182a
 pkgrel=2
 pkgdesc="Linux client of Feilian (veCorpLink) from Bytedance."
 arch=('x86_64')
 url="https://www.volcengine.com/product/feilian"
 license=('unknown')
-depends=('gtk3' 'libxss' 'nss' 'dnsmasq' 'iw')
+depends=('gtk3' 'libxss' 'nss' 'dnsmasq' 'iw' 'iproute2')
 optdepends=('networkmanager: NetworkManager integration')
 options=('!strip' '!emptydirs')
 install=${pkgname}.install
 source=("https://cdn.isealsuite.com/linux/FeiLian_Linux_amd64_v${pkgver}_$_pkgrel.deb")
-sha512sums=('e6d2415ae8c972daeccdf3a43344284c7ba0a5fabbfe736d0c2f61463042b7871bb6f9bb94ac2f56b86cb0b6fe83fe6865c63222850ede790215f09ed70d7899')
+sha512sums=('129731f371215d1ef2f15a7746c7bd16404e1e4ba287d5f238d1bc240e3b279214e3b15a6468d674b0127f533e03a31e496e1ed301701075ca4320a1c7016e1e')
 
 package() {
   # Extract package data
@@ -25,6 +25,16 @@
   ln -s /opt/apps/com.volcengine.feilian/files/corplink usr/bin/corplink
   mv "${pkgdir}"/opt/apps/com.volcengine.feilian/files/corplink.service usr/lib/systemd/system/corplink.service
 
+  # The upstream unit starts after network.target, which can be reached before
+  # NetworkManager has brought up an interface and configured DNS.  Wait for
+  # network-online and a default route so the client initializes its connection
+  # only after the host has usable network connectivity.
+  sed -i \
+    -e 's/^After=network.target$/After=network-online.target/' \
+    -e '/^Description=/a Wants=network-online.target' \
+    -e '/^\[Service\]$/a ExecStartPre=/usr/bin/sh -c "until /usr/bin/ip route show default | /usr/bin/grep -q default; do /usr/bin/sleep 1; done"' \
+    usr/lib/systemd/system/corplink.service
+
   rm -r usr/local
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 09:19:26	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2