dimagent-bin

MEDIUM

maintainer zerob13 0 votes scanned 2026-09-02 09:54:23.615266

View on AUR

Why flagged

A prebuilt binary .deb is downloaded from a non-official CDN host (dimcode.echooai.com) unrelated to the project's own domain (dimagent.cn), making it a swappable third-party artifact; the sha512 checksum provides some integrity guarantee but the host is not the project's canonical infrastructure, and the package installs a setuid Electron binary directly into the system.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("$_deb::https://dimcode.echooai.com/updates/stable/linux/x64/DimAgent-$pkgver.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): A prebuilt binary .deb is downloaded from a non-official CDN host (dimcode.echooai.com) unrelated to the project's own domain (dimagent.cn), making it a swappable third-party artifact; the sha512 checksum provides some integrity guarantee but the host is not the project's canonical infrastructure, and the package installs a setuid Electron binary directly into the system.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: DimAgent <app@fazhitech.com>
    
      2# Generated by scripts/generate-desktop-aur-package.mjs — do not edit by hand.
    
      3pkgname=dimagent-bin
    
      4pkgver=0.9.19
    
      5pkgrel=1
    
      6pkgdesc="DimAgent desktop client — AI coding agent"
    
      7arch=('x86_64')
    
      8url="https://dimagent.cn"
    
      9license=('LicenseRef-DimAgent-EULA')
    
      10depends=('gtk3' 'nss' 'alsa-lib' 'libcups' 'libxtst' 'libxss' 'libsecret' 'libnotify' 'at-spi2-core' 'mesa' 'xdg-utils')
    
      11optdepends=('libappindicator-gtk3: tray icon on desktops without StatusNotifier')
    
      12provides=('dimagent')
    
      13conflicts=('dimagent')
    
      14options=('!strip' '!debug' '!lto')
    
      15_deb=DimAgent-$pkgver.deb
    
      16source=("$_deb::https://dimcode.echooai.com/updates/stable/linux/x64/DimAgent-$pkgver.deb")
    
      17sha512sums=('3b7ff836e19872a22650ab3c15ea08bfa87b9516634ad33f9ab782c48e062282bc3e8ec79d1224ddbd63b60e6f558cfb8a150c1e67ee892a0dbc549347fe1536')
    
      18# makepkg has no extractor for .deb, and the payload is unpacked in package()
    
      19# straight into $pkgdir anyway.
    
      20noextract=("$_deb")
    
      21
    
      22package() {
    
      23  bsdtar -O -xf "$srcdir/$_deb" data.tar.xz | bsdtar -C "$pkgdir" -xf -
    
      24
    
      25  # Debian's changelog has no meaning in a pacman package.
    
      26  rm -rf "$pkgdir/usr/share/doc"
    
      27
    
      28  # Electron's sandbox helper has to be setuid root or the app refuses to start
    
      29  # with "SUID sandbox helper binary was found, but is not configured correctly".
    
      30  # The .deb sets this from its postinst, which pacman never runs.
    
      31  chmod 4755 "$pkgdir/opt/DimAgent/chrome-sandbox"
    
      32
    
      33  # The .deb ships no launcher on PATH; its desktop entry runs the binary by
    
      34  # absolute path.
    
      35  install -d "$pkgdir/usr/bin"
    
      36  ln -s "/opt/DimAgent/DimAgent" "$pkgdir/usr/bin/dimagent"
    
      37
    
      38  install -Dm644 "$pkgdir/opt/DimAgent/LICENSE.electron.txt" \
    
      39    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-02 09:54:23	Medium	3
2026-09-02 09:50:35	Medium	3