edrawmax-cn

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:28 source_x86_64=("${pkgname}-${pkgver}.deb::https://cc-download.wondershare.cc/business/prd/edrawmax_cn_full5374.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from wondershare.cc, which is a Wondershare-owned CDN domain (Wondershare is the parent company of Edrawsoft/EdrawMax). This is not a random personal host — wondershare.cc is the official Wondershare CDN used for distributing their software in China. The commented-out alternative source (cc-download.edrawsoft.cn) confirms this is the same vendor's content served from a different CDN hostname. However, the host is not the canonical edrawsoft.cn domain, the URL contains an opaque version string (edrawmax_cn_full5374.deb) rather than the pkgver, and the package installs a prebuilt proprietary binary blob directly into /opt without any integrity verification beyond a single sha256sum. This constitutes a real supply-chain concern: if wondershare.cc is compromised or the artifact is silently replaced, users receive arbitrary executed code. The sha256sum provides some protection but only against the specific artifact at review time. Rated medium rather than high because wondershare.cc is plausibly the legitimate vendor CDN, not a clearly hostile or personal host, and there is no evidence of active malice.