doc2x

maintainer AsukaMinato · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows installer EXE from an S3 bucket on the China-region AWS endpoint (s3.cn-north-1.amazonaws.com.cn), unpacks it with 7z, extracts the Electron app bundle with asar, patches the JavaScript source to spoof platform detection, and installs the result to run under the system electron24. The core concern is that this is a closed-source, prebuilt binary blob from a non-official, region-specific S3 host with no verifiable provenance beyond a single SHA-256 checksum. The extracted and patched JavaScript (app/dist/main/index.cjs) is executed directly by electron24, meaning any malicious code in the upstream EXE or asar bundle would run with user privileges. The platform-spoofing patch ('process.platform' -> 'darwin') and isPackaged override are suspicious but could be legitimate workarounds for UI differences. There is no upstream signature verification. This is a genuine supply-chain risk: a compromised or substituted S3 object would result in code execution, and the closed-source nature prevents auditing. Not clearly malicious, but a real medium-severity concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://doc2x-public.s3.cn-north-1.amazonaws.com.cn/win/doc2x_1.2.11.exe")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The PKGBUILD downloads a prebuilt Windows installer EXE from an S3 bucket on the China-region AWS endpoint (s3.cn-north-1.amazonaws.com.cn), unpacks it with 7z, extracts the Electron app bundle with asar, patches the JavaScript source to spoof platform detection, and installs the result to run under the system electron24. The core concern is that this is a closed-source, prebuilt binary blob from a non-official, region-specific S3 host with no verifiable provenance beyond a single SHA-256 checksum. The extracted and patched JavaScript (app/dist/main/index.cjs) is executed directly by electron24, meaning any malicious code in the upstream EXE or asar bundle would run with user privileges. The platform-spoofing patch ('process.platform' -> 'darwin') and isPackaged override are suspicious but could be legitimate workarounds for UI differences. There is no upstream signature verification. This is a genuine supply-chain risk: a compromised or substituted S3 object would result in code execution, and the closed-source nature prevents auditing. Not clearly malicious, but a real medium-severity concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Your Name <youremail@domain.com>
    
      2pkgname=doc2x
    
      3pkgver=1.2.11
    
      4pkgrel=1
    
      5epoch=
    
      6pkgdesc="doc2x"
    
      7arch=(x86_64)
    
      8url="https://doc2x.noedgeai.com/"
    
      9license=('private')
    
      10depends=(electron24 glibc libx11 bash)
    
      11makedepends=(p7zip asar)
    
      12provides=(doc2x)
    
      13source=("https://doc2x-public.s3.cn-north-1.amazonaws.com.cn/win/doc2x_1.2.11.exe")
    
      14sha256sums=('f4229345a8866d307f52c8c8ee39802330c93d754510e65039fd4310eff7bafd')
    
      15
    
      16prepare() {
    
      17	7z x *.exe
    
      18	pushd "\$PLUGINSDIR"
    
      19	7z x app-64.7z
    
      20	pushd resources
    
      21	asar e app.asar ../../app
    
      22	popd
    
      23	popd
    
      24	sed -i 's@F.app.isPackaged@(true)@g
    
      25		s@process.platform@"darwin"@g' app/dist/main/index.cjs # mac has window decoration
    
      26	find app -iname "*.exe" -print -delete
    
      27	find app \( -name "cli.js" -or -name "bin.js" \) -print -delete
    
      28	find app \( -path "*/node_modules/*/bin/*" -or -path "*/man/man1/*" \) -print -delete
    
      29	find . -type d -empty -delete
    
      30}
    
      31
    
      32package() {
    
      33	install -vd $pkgdir/opt/$pkgname
    
      34	cp -a $srcdir/app $pkgdir/opt/$pkgname/app
    
      35	printf "#!/bin/sh
    
      36ELECTRON_IS_DEV=false ELECTRON_ENABLE_LOGGING=1 exec electron24 /opt/$pkgname/app \"\$@\"
    
      37" | install -Dm755 /dev/stdin "$pkgdir/usr/bin/$pkgname"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2