cyberchef-web-cn-git

maintainer dnrops · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt CyberChef release ZIP from a personal/third-party GitCode.net repository (gitcode.net/dnrops/cyberchef-web) rather than the canonical upstream release at github.com/gchq/CyberChef. Additionally, sha256sums is set to 'SKIP', meaning there is no integrity verification of the downloaded archive. CyberChef bundles a large amount of JavaScript that executes in a browser context, and the single-file HTML build contains all logic inline. While the content is nominally 'data' (HTML/JS served as a web app), it is executable JavaScript code sourced from an unofficial personal mirror with no checksum validation — a genuine supply-chain concern. If the gitcode.net repo or the maintainer's account were compromised, malicious JS could be silently substituted. This is a real medium-severity supply-chain risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("$pkgname-$pkgver.zip::https://gitcode.net/dnrops/cyberchef-web/-/raw/master/CyberChef_v10.5.2.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The package downloads a prebuilt CyberChef release ZIP from a personal/third-party GitCode.net repository (gitcode.net/dnrops/cyberchef-web) rather than the canonical upstream release at github.com/gchq/CyberChef. Additionally, sha256sums is set to 'SKIP', meaning there is no integrity verification of the downloaded archive. CyberChef bundles a large amount of JavaScript that executes in a browser context, and the single-file HTML build contains all logic inline. While the content is nominally 'data' (HTML/JS served as a web app), it is executable JavaScript code sourced from an unofficial personal mirror with no checksum validation — a genuine supply-chain concern. If the gitcode.net repo or the maintainer's account were compromised, malicious JS could be silently substituted. This is a real medium-severity supply-chain risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andrew Ryan <dnrops@outlook.com>
    
      2#
    
      3
    
      4pkgname="cyberchef-web-cn-git"
    
      5_pkgname="cyberchef-web"
    
      6pkgver=10.5.2
    
      7pkgrel=1
    
      8pkgdesc="The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis"
    
      9url="https://gchq.github.io/CyberChef/"
    
      10license=("Apache 2.0")
    
      11arch=("any")
    
      12conflicts=("cyberchef-html")
    
      13replaces=("cyberchef-html")
    
      14makedepends=("unzip")
    
      15source=("$pkgname-$pkgver.zip::https://gitcode.net/dnrops/cyberchef-web/-/raw/master/CyberChef_v10.5.2.zip")
    
      16noextract=("$pkgname-$pkgver.zip")
    
      17sha256sums=('SKIP')
    
      18options=("!strip")
    
      19
    
      20package(){
    
      21 install -d "$pkgdir/usr/share/webapps"
    
      22 unzip -q -o "$pkgname-$pkgver.zip" -d "$pkgdir/usr/share/webapps/cyberchef"
    
      23 mv "$pkgdir/usr/share/webapps/cyberchef/CyberChef_v$pkgver.html" "$pkgdir/usr/share/webapps/cyberchef/index.html"
    
      24}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2