feem

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary AppImage from Backblaze B2 storage (f000.backblazeb2.com/file/feemdownloads/), which is the official Feem download host used by the vendor (feem.io links to Backblaze B2 for downloads). The binary is then extracted and installed directly. While Backblaze B2 is a legitimate CDN/storage service and this appears to be the actual vendor's distribution channel, it is not a canonical software repository and the file could theoretically be replaced. A sha256sum is present, which mitigates silent substitution risk somewhat, though the hash itself could be wrong or outdated. The core concern is that a closed-source, prebuilt binary from a third-party storage host is being extracted and installed as a system binary — this is a real supply-chain concern (executed binary from non-standard host) even if it appears to be the legitimate vendor distribution method. The cheaper model's MEDIUM rating is appropriate here.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://f000.backblazeb2.com/file/feemdownloads/Feem-${pkgver}-x86_64.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary AppImage from Backblaze B2 storage (f000.backblazeb2.com/file/feemdownloads/), which is the official Feem download host used by the vendor (feem.io links to Backblaze B2 for downloads). The binary is then extracted and installed directly. While Backblaze B2 is a legitimate CDN/storage service and this appears to be the actual vendor's distribution channel, it is not a canonical software repository and the file could theoretically be replaced. A sha256sum is present, which mitigates silent substitution risk somewhat, though the hash itself could be wrong or outdated. The core concern is that a closed-source, prebuilt binary from a third-party storage host is being extracted and installed as a system binary — this is a real supply-chain concern (executed binary from non-standard host) even if it appears to be the legitimate vendor distribution method. The cheaper model's MEDIUM rating is appropriate here.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: qaz <fkxxyz@163.com>
    
      2# Contributor: qaz <fkxxyz@163.com>
    
      3
    
      4pkgname=feem
    
      5pkgver=4.4.2
    
      6pkgrel=1
    
      7pkgdesc="Share Files in LAN. OFFLINE! No Cloud. No Servers. No Limits."
    
      8arch=("x86_64")
    
      9url="https://www.feem.io/"
    
      10license=('custom')
    
      11makedepends=('p7zip')
    
      12depends=('qt5-webkit' 'hicolor-icon-theme')
    
      13optdepends=('gstreamer: multimedia support')
    
      14source=(
    
      15  "https://f000.backblazeb2.com/file/feemdownloads/Feem-${pkgver}-x86_64.AppImage"
    
      16)
    
      17
    
      18prepare() {
    
      19  cd "${srcdir}"
    
      20  7z x -y "Feem-${pkgver}-x86_64.AppImage"
    
      21}
    
      22
    
      23package() {
    
      24  cd "${srcdir}"
    
      25
    
      26  install -d "${pkgdir}/usr/share"
    
      27
    
      28  cp -a ./usr/share/icons "${pkgdir}/usr/share/icons"
    
      29  cp -a ./usr/share/applications "${pkgdir}/usr/share/applications"
    
      30  find "${pkgdir}/usr" -type d -exec chmod 755 {} \;
    
      31
    
      32  install -D ./usr/bin/Feem "${pkgdir}/usr/bin/feem"
    
      33
    
      34  install -d "${pkgdir}/usr/share/licenses/$pkgname"
    
      35  echo '
    
      36
    
      37© FeePerfect. All rights reserved.
    
      38
    
      39Created By Fritz Ekwoge
    
      40From the beautiful city of Buea, Cameroon.
    
      41
    
      42About Us
    
      43	We are FeePerfect. A small, high-tech company providing innovative ideas 
    
      44	for people and businesses. We are based in Cameroon, Africa. Our award 
    
      45	winning products help people solve problems that they deal with each and 
    
      46	every day. We will always work hard to please our customers and are always 
    
      47	happy to do business with you.
    
      48
    
      49Send us an email: info@feeperfect.com and we''ll be glad to help.
    
      50' > "${pkgdir}/usr/share/licenses/$pkgname/LICENSE"
    
      51}
    
      52
    
      53# vim:set ts=2 sw=2 et:
    
      54sha256sums=('3934df10fae0b93fc975ffdda462e82022252ea7c684114628cbce28cb775e8a')
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2