corplink-bin

MEDIUM

maintainer lance6716 4 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (cdn.isealsuite.com), which is not ByteDance's official domain, creating a supply-chain risk if the host is compromised or malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://cdn.isealsuite.com/linux/FeiLian_Linux_amd64_v${pkgver}_$_pkgrel.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (cdn.isealsuite.com), which is not ByteDance's official domain, creating a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jat <chat@jat.email>
    
      2
    
      3pkgname=corplink-bin
    
      4pkgver=3.3.21
    
      5_pkgrel=r9149_dad61a
    
      6pkgrel=1
    
      7pkgdesc="Linux client of Feilian (veCorpLink) from Bytedance."
    
      8arch=('x86_64')
    
      9url="https://www.volcengine.com/product/feilian"
    
      10license=('unknown')
    
      11depends=('gtk3' 'libxss' 'nss' 'dnsmasq' 'iw' 'iproute2')
    
      12optdepends=('networkmanager: NetworkManager integration')
    
      13options=('!strip' '!emptydirs')
    
      14install=${pkgname}.install
    
      15source=("https://cdn.isealsuite.com/linux/FeiLian_Linux_amd64_v${pkgver}_$_pkgrel.deb")
    
      16sha512sums=('d6ad5013ac3a6a7440db4f1555a964619679a5c40e4f9537b13c40ab8097da32b05667b206bf9f550ad7cfb2f6abccadbd67b11adbb46cbdfbe774aea15947f4')
    
      17
    
      18package() {
    
      19  # Extract package data
    
      20  tar xpvf "${srcdir}/data.tar.xz" --xattrs-include='*' --no-same-owner -C "${pkgdir}"
    
      21
    
      22  # Fix directory structure differences
    
      23  cd "${pkgdir}"
    
      24  mkdir -p usr/bin usr/lib/systemd/system
    
      25  ln -s /opt/apps/com.volcengine.feilian/files/corplink usr/bin/corplink
    
      26  mv "${pkgdir}"/opt/apps/com.volcengine.feilian/files/corplink.service usr/lib/systemd/system/corplink.service
    
      27
    
      28  # The upstream unit starts after network.target, which can be reached before
    
      29  # NetworkManager has brought up an interface and configured DNS.  Wait for
    
      30  # network-online and a default route so the client initializes its connection
    
      31  # only after the host has usable network connectivity.
    
      32  sed -i \
    
      33    -e 's/^After=network.target$/After=network-online.target/' \
    
      34    -e '/^Description=/a Wants=network-online.target' \
    
      35    -e '/^\[Service\]$/a ExecStartPre=/usr/bin/sh -c "until /usr/bin/ip route show default | /usr/bin/grep -q default; do /usr/bin/sleep 1; done"' \
    
      36    usr/lib/systemd/system/corplink.service
    
      37
    
      38  rm -r usr/local
    
      39}
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-10-14 03:18
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,9 +1,9 @@
 # Maintainer: Jat <chat@jat.email>
 
 pkgname=corplink-bin
-pkgver=3.2.16
-_pkgrel=r8362_0d182a
-pkgrel=2
+pkgver=3.3.21
+_pkgrel=r9149_dad61a
+pkgrel=1
 pkgdesc="Linux client of Feilian (veCorpLink) from Bytedance."
 arch=('x86_64')
 url="https://www.volcengine.com/product/feilian"
@@ -13,7 +13,7 @@
 options=('!strip' '!emptydirs')
 install=${pkgname}.install
 source=("https://cdn.isealsuite.com/linux/FeiLian_Linux_amd64_v${pkgver}_$_pkgrel.deb")
-sha512sums=('129731f371215d1ef2f15a7746c7bd16404e1e4ba287d5f238d1bc240e3b279214e3b15a6468d674b0127f533e03a31e496e1ed301701075ca4320a1c7016e1e')
+sha512sums=('d6ad5013ac3a6a7440db4f1555a964619679a5c40e4f9537b13c40ab8097da32b05667b206bf9f550ad7cfb2f6abccadbd67b11adbb46cbdfbe774aea15947f4')
 
 package() {
   # Extract package data

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 05:19:21	Medium	2
2026-10-14 03:18:50	Medium	2