eusoft-eshelper-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:50 "${pkgname%-bin}-${pkgver}.deb::https://www.eudic.net/download/${_pkgname}.deb?v=${pkgver//./-}"
• PKGBUILD:51 "LICENSE.html::https://dict.eudic.net/home/privacy"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt .deb binary from eudic.net (the official vendor for Eudic dictionary apps, a well-known Chinese software company) and installs it. While eudic.net is the legitimate upstream vendor for this software, the source is still a prebuilt binary blob from a non-open-source proprietary application. The sha256sums are pinned, which mitigates substitution attacks at build time, but the URL uses a version-substituted query parameter (?v=${pkgver//./-}) which could theoretically serve different content for the same checksum if the server is compromised or the file changes. The core concern is that this is a closed-source prebuilt binary being installed system-wide — if the upstream vendor's server is compromised or the binary contains malicious code, there is no way to audit it. This is a genuine medium-severity supply-chain concern: executed proprietary binary from a vendor host with no source code available, though the sha256 pinning does provide some integrity guarantee. Not high because there is no evidence of actual malice, obfuscation, or unofficial/personal hosting — eudic.net is the legitimate vendor.