devin-desktop

maintainer gerliczkowalczuk · 29 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-whitelisted, project-unrelated host (codeiumdata.com) which is not the official project domain, creating a supply-chain risk if the host is compromised or the download is swapped.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-whitelisted, project-unrelated host (codeiumdata.com) which is not the official project domain, creating a supply-chain risk if the host is compromised or the download is swapped.

PKGBUILD

      1# Contributor: Luiz Silva <luizsv.dev@gmail.com>
    
      2pkgname=devin-desktop
    
      3pkgver=3.4.27
    
      4pkgrel=2
    
      5pkgdesc="A team of agents for every engineer — Devin Desktop"
    
      6arch=('x86_64')
    
      7url="https://devin.ai/desktop"
    
      8license=('LicenseRef-Devin Desktop')
    
      9depends=( fd ripgrep xdg-utils
    
      10  alsa-lib
    
      11  dbus
    
      12  gnupg
    
      13  libnotify
    
      14  libsecret
    
      15  libxss
    
      16  libxkbfile
    
      17)
    
      18
    
      19options=('!strip')  # needed for sig of ext ?
    
      20
    
      21# To update: curl -s https://windsurf-stable.codeium.com/api/update/linux-x64-deb/stable/latest | jq -r '.url,.sha256hash'
    
      22_url="https://windsurf-stable.codeiumdata.com/linux-x64-deb/stable/0d4bf12ed4a7597cb8ae9016fe8474468aad98a2/Devin-linux-x64-${pkgver}.deb"
    
      23source=("${pkgname}-${pkgver}.deb::$_url"
    
      24"https://gitlab.archlinux.org/archlinux/packaging/packages/code/-/raw/main/code.sh")
    
      25b2sums=('16db93e19459d17b8da85ca5de7d92869f3500fd9fb2e7f2d0432571119f886a248daec9162df9abc0c30dc376aa18ef5c7202777393ff4921b0ab82720ffe4c'
    
      26'04759111dcb50b5811a96085fee9384c89a583431a9da510dd06f2675fe80cf7becd5d12bcbdc92c08f16ba6e2093947fc9eb9007827c2e76244cd4be8615946')
    
      27noextract=(${pkgname}-${pkgver}.deb) # avoid double tarball
    
      28
    
      29prepare() {
    
      30  bsdtar -xOf ${noextract[0]} data.tar.xz | tar -xJf - --exclude "usr/share/${pkgname}/[^r]*" --exclude "usr/share/${pkgname}/*.pak"
    
      31  #bsdtar xf data.tar.xz --exclude 'usr/share/devin-desktop/[^r]*' --exclude 'usr/share/devin-desktop/*.pak'
    
      32  _app=/usr/share/devin-desktop/resources/app
    
      33  sed code.sh \
    
      34    -e "s|/usr/lib/code/out/cli.js|${_app}/out/cli.js|" \
    
      35    -e "s|/usr/lib/code/code.mjs|--app=${_app}|" > run.sh
    
      36  ln -svf /usr/bin/fd usr/share/$pkgname/resources/app/extensions/windsurf/bin/fd
    
      37  ln -svf /usr/bin/rg usr/share/$pkgname/resources/app/node_modules/@vscode/ripgrep/bin/rg
    
      38  ln -svf /usr/bin/xdg-open usr/share/$pkgname/resources/app/node_modules/open/xdg-open
    
      39}
    
      40
    
      41package(){
    
      42  _electron=electron$(rg -o -r '$1' '"electron": *"[^0-9]*([0-9]+)' usr/share/${pkgname}/resources/app/package.json)
    
      43  echo $_electron
    
      44  mv usr "${pkgdir}/usr"
    
      45  sed "s|name=electron|name=${_electron}|" run.sh > run-e.sh
    
      46  install -Dm755 run-e.sh "${pkgdir}/usr/bin/${pkgname}"
    
      47  depends+=(${_electron}) # hidden from --printsrcinfo
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-07-07 13:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,53 +1,49 @@
-# Maintainer: Luiz Silva <luizsv.dev@gmail.com>
+# Contributor: Luiz Silva <luizsv.dev@gmail.com>
 pkgname=devin-desktop
-pkgver=3.3.18
-pkgrel=1
+pkgver=3.4.27
+pkgrel=2
 pkgdesc="A team of agents for every engineer — Devin Desktop"
 arch=('x86_64')
 url="https://devin.ai/desktop"
 license=('LicenseRef-Devin Desktop')
-depends=(
-    'glibc>=2.28'
-    'gcc-libs'
-    'gtk3'
-    'nss'
-    'mesa'
-    'alsa-lib'
-    'libsecret'
-    'libxss'
-    'libxtst'
-    'xdg-utils'
-    'libxkbcommon'
-    'dbus'
-    'expat'
-    'libcups'
-    'util-linux-libs'
-    'libxkbfile'
-    'libxrandr'
+depends=( fd ripgrep xdg-utils
+  alsa-lib
+  dbus
+  gnupg
+  libnotify
+  libsecret
+  libxss
+  libxkbfile
 )
-optdepends=(
-    'libnotify: Desktop notifications'
-    'org.freedesktop.secrets: Keyring support'
-    'libdbusmenu-glib: KDE global menu'
-    'gtk2: GTK2 theme support'
-    'gvfs: Trash functionality'
-)
-options=('!strip')
-conflicts=('devin-desktop-bin' 'windsurf-bin' 'windsurf')
-install=devin-desktop.install
+
+options=('!strip')  # needed for sig of ext ?
 
 # To update: curl -s https://windsurf-stable.codeium.com/api/update/linux-x64-deb/stable/latest | jq -r '.url,.sha256hash'
-_url="https://windsurf-stable.codeiumdata.com/linux-x64-deb/stable/16737566f57f3b53bde136375fe0544eca12fac4/Devin-linux-x64-${pkgver}.deb"
-source=("devin-desktop-${pkgver}.deb::$_url")
-sha256sums=('694ba5797d6ba5133ffbb73a244f47c020358b1fd66366da2dc08b116c609fdd')
+_url="https://windsurf-stable.codeiumdata.com/linux-x64-deb/stable/0d4bf12ed4a7597cb8ae9016fe8474468aad98a2/Devin-linux-x64-${pkgver}.deb"
+source=("${pkgname}-${pkgver}.deb::$_url"
+"https://gitlab.archlinux.org/archlinux/packaging/packages/code/-/raw/main/code.sh")
+b2sums=('16db93e19459d17b8da85ca5de7d92869f3500fd9fb2e7f2d0432571119f886a248daec9162df9abc0c30dc376aa18ef5c7202777393ff4921b0ab82720ffe4c'
+'04759111dcb50b5811a96085fee9384c89a583431a9da510dd06f2675fe80cf7becd5d12bcbdc92c08f16ba6e2093947fc9eb9007827c2e76244cd4be8615946')
+noextract=(${pkgname}-${pkgver}.deb) # avoid double tarball
 
-package() {
-    cd "$srcdir"
-    ar x "devin-desktop-${pkgver}.deb"
-    tar -xJf data.tar.xz -C "$pkgdir"
-
-    # The deb postinst creates this symlink; we handle it here for pacman
-    install -dm755 "$pkgdir/usr/bin"
-    ln -sf "/usr/share/devin-desktop/bin/devin-desktop" "$pkgdir/usr/bin/devin-desktop"
+prepare() {
+  bsdtar -xOf ${noextract[0]} data.tar.xz | tar -xJf - --exclude "usr/share/${pkgname}/[^r]*" --exclude "usr/share/${pkgname}/*.pak"
+  #bsdtar xf data.tar.xz --exclude 'usr/share/devin-desktop/[^r]*' --exclude 'usr/share/devin-desktop/*.pak'
+  _app=/usr/share/devin-desktop/resources/app
+  sed code.sh \
+    -e "s|/usr/lib/code/out/cli.js|${_app}/out/cli.js|" \
+    -e "s|/usr/lib/code/code.mjs|--app=${_app}|" > run.sh
+  ln -svf /usr/bin/fd usr/share/$pkgname/resources/app/extensions/windsurf/bin/fd
+  ln -svf /usr/bin/rg usr/share/$pkgname/resources/app/node_modules/@vscode/ripgrep/bin/rg
+  ln -svf /usr/bin/xdg-open usr/share/$pkgname/resources/app/node_modules/open/xdg-open
 }
 
+package(){
+  _electron=electron$(rg -o -r '$1' '"electron": *"[^0-9]*([0-9]+)' usr/share/${pkgname}/resources/app/package.json)
+  echo $_electron
+  mv usr "${pkgdir}/usr"
+  sed "s|name=electron|name=${_electron}|" run.sh > run-e.sh
+  install -Dm755 run-e.sh "${pkgdir}/usr/bin/${pkgname}"
+  depends+=(${_electron}) # hidden from --printsrcinfo
+}
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 11:10:52	MEDIUM	2
2026-07-19 07:10:24	CLEAN	0
2026-07-07 13:24:27	CLEAN	0
2026-06-25 12:22:11	CLEAN	0
2026-06-19 22:34:54	CLEAN	0