flat-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Windows .exe installer from Alibaba Cloud OSS (flat-storage.oss-accelerate.aliyuncs.com), extracts its 'resources' directory (containing app.asar), and runs it under electron12. While aliyuncs.com is Alibaba's official cloud storage service and this appears to be the legitimate Agora Flat project's distribution host, there are real concerns: (1) a Windows .exe is being used as the source for a Linux package, relying on whatever extraction happens implicitly — the PKGBUILD uses 'find . -name resources' which suggests the AUR helper/makepkg is expected to unpack the NSIS installer somehow, which is non-standard and fragile; (2) the app.asar bundle is executed as-is under electron12 with no integrity verification beyond the md5sum of the original exe (MD5 is weak); (3) the host is not the upstream GitHub releases page but a CDN bucket, which could be controlled by the project but is less auditable. The executed code (app.asar) comes from an unofficial binary distribution channel rather than a source build. This is a genuine supply-chain concern — prebuilt, opaque JavaScript bundle from a CDN — but not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://flat-storage.oss-accelerate.aliyuncs.com/versions/latest/stable/win/Flat-x64-$pkgver.exe"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt Windows .exe installer from Alibaba Cloud OSS (flat-storage.oss-accelerate.aliyuncs.com), extracts its 'resources' directory (containing app.asar), and runs it under electron12. While aliyuncs.com is Alibaba's official cloud storage service and this appears to be the legitimate Agora Flat project's distribution host, there are real concerns: (1) a Windows .exe is being used as the source for a Linux package, relying on whatever extraction happens implicitly — the PKGBUILD uses 'find . -name resources' which suggests the AUR helper/makepkg is expected to unpack the NSIS installer somehow, which is non-standard and fragile; (2) the app.asar bundle is executed as-is under electron12 with no integrity verification beyond the md5sum of the original exe (MD5 is weak); (3) the host is not the upstream GitHub releases page but a CDN bucket, which could be controlled by the project but is less auditable. The executed code (app.asar) comes from an unofficial binary distribution channel rather than a source build. This is a genuine supply-chain concern — prebuilt, opaque JavaScript bundle from a CDN — but not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aron Young <tkf6fkt at gmail dot com>
    
      2
    
      3pkgname=flat-bin
    
      4pkgver=2.2.3
    
      5pkgrel=1
    
      6pkgdesc="the client of Agora Flat open source classroom."
    
      7arch=(x86_64 aarch64)
    
      8url="https://flat.whiteboard.agora.io/"
    
      9license=('MIT')
    
      10depends=(electron12 bash)
    
      11provides=(flat)
    
      12source=("https://flat-storage.oss-accelerate.aliyuncs.com/versions/latest/stable/win/Flat-x64-$pkgver.exe"
    
      13    "https://raw.githubusercontent.com/netless-io/flat/main/LICENSE"
    
      14    $pkgname.desktop
    
      15)
    
      16md5sums=('dcb2a9a765f7e4db74f4e4019e26a7e5'
    
      17         '51dc5dc7139da3157a898b0265f34ab6'
    
      18         '1d7d38434279d9a35429cd2546df622e')
    
      19
    
      20package() {
    
      21    install -d "$pkgdir"/opt/$pkgname
    
      22    find . -name "resources" -type d -exec cp -av {} $pkgdir/opt/$pkgname/ \;
    
      23    echo -e "#!/bin/bash\nelectron12 /opt/$pkgname/resources/app.asar" | install -Dm755 /dev/stdin $pkgdir/usr/bin/flat
    
      24    install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      25    install -Dm644 $pkgname.desktop -t "$pkgdir"/usr/share/applications/
    
      26    find . -name "logo-2844c382.svg" -exec install -Dm644 {} "$pkgdir"/usr/share/pixmaps/$pkgname.svg \;
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2