easyconnect-hust

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("https://download.sangfor.com.cn/download/product/sslvpn/pkg/linux_767/EasyConnect_x64_7_6_7_3.deb"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from sangfor.com.cn (the vendor's own domain for their enterprise VPN client) and also downloads pango source from ftp.gnome.org to compile and install a custom pango library. The main concerns are: (1) the binary .deb is from a vendor domain rather than a standard code-hosting platform, and while sangfor.com.cn is the legitimate vendor for EasyConnect/SSL VPN software widely used in Chinese universities, it is not a transparent source; (2) the package() function runs 'tar xzf data.tar.gz' without specifying a path, relying on the .deb extraction having already unpacked data.tar.gz into the current directory — this is fragile but not malicious; (3) the pango source is from ftp.gnome.org which is a legitimate GNOME mirror, and it is compiled from source with checksums verified; (4) md5sums are used rather than sha256sums, which is weaker but not absent. The overall pattern is consistent with a legitimate but unofficial repackaging of enterprise VPN software — a common AUR pattern for Chinese university VPN clients. The binary blob from the vendor is the primary supply-chain concern: if sangfor.com.cn were compromised, the binary could be replaced. This is a real medium-severity concern but not evidence of active malice.