easyconnect-rpc

maintainer sunflowercx · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from download.sangfor.com.cn, which is the official Sangfor vendor domain (Sangfor Technologies is the developer of EasyConnect VPN). This is not a random personal host — it is the legitimate upstream vendor's download server. However, the package installs a closed-source, prebuilt binary VPN client without any cryptographic verification (only MD5 checksums, which are weak), and the binary runs with elevated network privileges. The pango source is fetched from the official GNOME mirror. The main concern is that a prebuilt proprietary binary from a Chinese vendor is being extracted and installed directly, with no signature verification, and the binary could contain arbitrary code. This is a genuine supply-chain concern (closed-source binary from a vendor with no GPG/SHA256 verification), but not evidence of active malice. Rating remains MEDIUM due to the executed proprietary binary from a non-open-source vendor host with only MD5 integrity checking.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://download.sangfor.com.cn/download/product/sslvpn/pkg/linux_767/EasyConnect_x64_7_6_7_3.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from download.sangfor.com.cn, which is the official Sangfor vendor domain (Sangfor Technologies is the developer of EasyConnect VPN). This is not a random personal host — it is the legitimate upstream vendor's download server. However, the package installs a closed-source, prebuilt binary VPN client without any cryptographic verification (only MD5 checksums, which are weak), and the binary runs with elevated network privileges. The pango source is fetched from the official GNOME mirror. The main concern is that a prebuilt proprietary binary from a Chinese vendor is being extracted and installed directly, with no signature verification, and the binary could contain arbitrary code. This is a genuine supply-chain concern (closed-source binary from a vendor with no GPG/SHA256 verification), but not evidence of active malice. Rating remains MEDIUM due to the executed proprietary binary from a non-open-source vendor host with only MD5 integrity checking.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: sunflowercx <1527981693@qq.com>
    
      2
    
      3pkgname=easyconnect-rpc
    
      4pkgver=7.6.7.3
    
      5pkgrel=2
    
      6pkgdesc="Accessing RPC's network resources over vpn connection."
    
      7arch=('x86_64')
    
      8url="https://vpn.rpc.edu.cn"
    
      9license=('custom')
    
      10depends=('gtk2' 'lib32-gtk2')
    
      11makedepends=('meson' 'gobject-introspection')
    
      12install=${pkgname}.install
    
      13source=("https://download.sangfor.com.cn/download/product/sslvpn/pkg/linux_767/EasyConnect_x64_7_6_7_3.deb"
    
      14        "https://download.gnome.org/sources/pango/1.43/pango-1.43.0.tar.xz")
    
      15md5sums=('a87cd6e5ecd521491b82d66682fe88f5'
    
      16         '2df040d3f6a4ed9bc316a70b35adcd8b')
    
      17package(){
    
      18        tar xf ${srcdir}/pango-1.43.0.tar.xz
    
      19        tar xzf data.tar.gz -C "${pkgdir}"
    
      20        cd pango-1.43.0
    
      21        meson builddir -Dprefix=/usr
    
      22        DESTDIR=${pkgdir}"/usr/share/sangfor/EasyConnect/oldlib/pango" meson install -C builddir
    
      23        cd ${pkgdir}
    
      24        sed -i 's/Exec=/Exec=env LD_LIBRARY_PATH=\/usr\/share\/sangfor\/EasyConnect\/oldlib\/pango\/usr\/lib /g' "${pkgdir}/usr/share/applications/EasyConnect.desktop"
    
      25        install -D -m644 "${pkgdir}/usr/share/sangfor/EasyConnect/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      26}
    
      27
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2