dolphin-anty-bin

maintainer komex · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt RPM binary from dolphin-anty-cdn.com, which is the official CDN for the Dolphin Anty antidetect browser product (matching the official site dolphin-anty.net). The domain is plausibly the vendor's own CDN rather than a random personal host. However, the source URL uses a 'latest' endpoint (dolphin-anty-linux-x86_64-latest.rpm) rather than a versioned/immutable URL, meaning the sha256sum pinned in the PKGBUILD could become stale or mismatched on future downloads, and the actual binary fetched at build time could differ from what was audited. The pkgver() function extracts the version from the downloaded binary after the fact, which is an unusual pattern. The binary is installed directly into the package without any source build, which is normal for -bin packages but means users are trusting the vendor CDN entirely. The sha256sum does provide a integrity check for the specific version audited. Overall this is a medium-risk supply-chain concern: a prebuilt closed-source binary from a CDN with a mutable 'latest' URL, but it appears to be the legitimate vendor's own distribution channel rather than a third-party rehost.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("${_file}::https://dolphin-anty-cdn.com/anty-app/dolphin-anty-linux-x86_64-latest.rpm")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt RPM binary from dolphin-anty-cdn.com, which is the official CDN for the Dolphin Anty antidetect browser product (matching the official site dolphin-anty.net). The domain is plausibly the vendor's own CDN rather than a random personal host. However, the source URL uses a 'latest' endpoint (dolphin-anty-linux-x86_64-latest.rpm) rather than a versioned/immutable URL, meaning the sha256sum pinned in the PKGBUILD could become stale or mismatched on future downloads, and the actual binary fetched at build time could differ from what was audited. The pkgver() function extracts the version from the downloaded binary after the fact, which is an unusual pattern. The binary is installed directly into the package without any source build, which is normal for -bin packages but means users are trusting the vendor CDN entirely. The sha256sum does provide a integrity check for the specific version audited. Overall this is a medium-risk supply-chain concern: a prebuilt closed-source binary from a CDN with a mutable 'latest' URL, but it appears to be the legitimate vendor's own distribution channel rather than a third-party rehost.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andrey Kolchenko <andrey@kolchenko.me>
    
      2
    
      3pkgname='dolphin-anty-bin'
    
      4pkgver=2026.147.225
    
      5pkgrel=1
    
      6pkgdesc='Antidetect browser for multi-accounting'
    
      7arch=('x86_64')
    
      8url='https://dolphin-anty.net/'
    
      9license=('custom:Proprietary')
    
      10options=(!strip)
    
      11provides=('dolphin-anty')
    
      12makedepends=('binutils' 'grep' 'coreutils')
    
      13
    
      14_file="${pkgname%-*}-${pkgver}.rpm"
    
      15
    
      16source=("${_file}::https://dolphin-anty-cdn.com/anty-app/dolphin-anty-linux-x86_64-latest.rpm")
    
      17sha256sums=('e8c5de3881d4008face9e729d681af2dbe9a7f1e2753f5592ff2a4b2e70bf0c6')
    
      18
    
      19pkgver() {
    
      20    strings "${_file}" | grep -m 1 'dolphin_anty-[^[:space:]]*' | cut -d- -f2-2
    
      21}
    
      22
    
      23package() {
    
      24    for item in usr opt; do
    
      25        cp -a "${srcdir}/${item}" "${pkgdir}"
    
      26    done
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2