cyberchef-web-cn-git

MEDIUM

maintainer dnrops 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt CyberChef release ZIP from a personal/third-party GitCode.net repository (gitcode.net/dnrops/cyberchef-web) rather than the canonical upstream release at github.com/gchq/CyberChef. Additionally, sha256sums is set to 'SKIP', meaning there is no integrity verification of the downloaded archive. CyberChef bundles a large amount of JavaScript that executes in a browser context, and the single-file HTML build contains all logic inline. While the content is nominally 'data' (HTML/JS served as a web app), it is executable JavaScript code sourced from an unofficial personal mirror with no checksum validation — a genuine supply-chain concern. If the gitcode.net repo or the maintainer's account were compromised, malicious JS could be silently substituted. This is a real medium-severity supply-chain risk, not a false positive.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("$pkgname-$pkgver.zip::https://gitcode.net/dnrops/cyberchef-web/-/raw/master/CyberChef_v10.5.2.zip")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The package downloads a prebuilt CyberChef release ZIP from a personal/third-party GitCode.net repository (gitcode.net/dnrops/cyberchef-web) rather than the canonical upstream release at github.com/gchq/CyberChef. Additionally, sha256sums is set to 'SKIP', meaning there is no integrity verification of the downloaded archive. CyberChef bundles a large amount of JavaScript that executes in a browser context, and the single-file HTML build contains all logic inline. While the content is nominally 'data' (HTML/JS served as a web app), it is executable JavaScript code sourced from an unofficial personal mirror with no checksum validation — a genuine supply-chain concern. If the gitcode.net repo or the maintainer's account were compromised, malicious JS could be silently substituted. This is a real medium-severity supply-chain risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andrew Ryan <dnrops@outlook.com>
    
      2#
    
      3
    
      4pkgname="cyberchef-web-cn-git"
    
      5_pkgname="cyberchef-web"
    
      6pkgver=10.5.2
    
      7pkgrel=1
    
      8pkgdesc="The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis"
    
      9url="https://gchq.github.io/CyberChef/"
    
      10license=("Apache 2.0")
    
      11arch=("any")
    
      12conflicts=("cyberchef-html")
    
      13replaces=("cyberchef-html")
    
      14makedepends=("unzip")
    
      15source=("$pkgname-$pkgver.zip::https://gitcode.net/dnrops/cyberchef-web/-/raw/master/CyberChef_v10.5.2.zip")
    
      16noextract=("$pkgname-$pkgver.zip")
    
      17sha256sums=('SKIP')
    
      18options=("!strip")
    
      19
    
      20package(){
    
      21 install -d "$pkgdir/usr/share/webapps"
    
      22 unzip -q -o "$pkgname-$pkgver.zip" -d "$pkgdir/usr/share/webapps/cyberchef"
    
      23 mv "$pkgdir/usr/share/webapps/cyberchef/CyberChef_v$pkgver.html" "$pkgdir/usr/share/webapps/cyberchef/index.html"
    
      24}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2