flclash-bin
maintainer zxp19821005
· 12 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a base64-encoded binary blob (libquickjs_c_bridge_plugin.so) from a personal GitHub Gist, decodes it, and installs it as a shared library; this constitutes an unverifiable prebuilt executable from a swappable host, creating a supply-chain risk.
Triggered rules
MEDIUM
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a base64-encoded binary blob (libquickjs_c_bridge_plugin.so) from a personal GitHub Gist, decodes it, and installs it as a shared library; this constitutes an unverifiable prebuilt executable from a swappable host, creating a supply-chain risk.
-
PKGBUILD:31
sha256sums_x86_64=('e3d7ad04d6918cbe40d69a146c214ab3674cfb8ce4494d6ab5ae5d8105fea643' -
PKGBUILD:32
'367033ae3a8bd11f37e398f38c5de0acd8985b62b93b966eb43648fba6bd9094')
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Dee.H.Y <dongfengweixiao AT hotmail DOT com>
2
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
3
pkgname=flclash-bin
4
_pkgname=FlClash
5
pkgver=0.8.94
6
pkgrel=1
7
pkgdesc="A multi-platform proxy client based on ClashMeta,simple and easy to use, open-source and ad-free."
8
arch=(
9
#'aarch64'
10
'x86_64'
11
)
12
url="https://github.com/chen08209/FlClash"
13
license=('GPL-3.0-only')
14
conflicts=("${pkgname%-bin}")
15
provides=("${pkgname%-bin}=${pkgver}")
16
depends=(
17
'libayatana-appindicator'
18
'ayatana-ido'
19
'libdbusmenu-glib'
20
'libkeybinder3'
21
)
22
source=(
23
"${pkgname%-bin}.sh"
24
)
25
#source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64.deb")
26
source_x86_64=(
27
"${pkgname%-bin}-${pkgver}-x86_64.deb::${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-amd64.deb"
28
"libquickjs_c_bridge_plugin.so.base64::https://gist.githubusercontent.com/dongfengweixiao/bbddee34d6456326200fac3463761296/raw/c18484d78449d0e3b376a6e2a49852486305ff1e/libquickjs_c_bridge_plugin.so.base64"
29
)
30
sha256sums=('3b8311438e88f47eb507322a43c7a4156bfebb8c0f6e7b7436ef70842fb4c745')
31
sha256sums_x86_64=('e3d7ad04d6918cbe40d69a146c214ab3674cfb8ce4494d6ab5ae5d8105fea643'
32
'367033ae3a8bd11f37e398f38c5de0acd8985b62b93b966eb43648fba6bd9094')
33
# sha256sums_aarch64=('b250a118058cadd5d3dde417f38c439c5d535ae0597a145be235d6cdcbf4e325')
34
prepare() {
35
sed -i -e "
36
s/@appname@/${pkgname%-bin}/g
37
s/@runname@/${_pkgname}/g
38
" "${srcdir}/${pkgname%-bin}.sh"
39
bsdtar -xf "${srcdir}/data."*
40
sed -i -e "
41
s/Exec=${_pkgname}/Exec=${pkgname%-bin}/g
42
s/Icon=${_pkgname}/Icon=${pkgname%-bin}/g
43
5i\Categories=Network;
44
10i\StartupWMClass=com.follow.clash
45
" "${srcdir}/usr/share/applications/${_pkgname}.desktop"
46
}
47
package() {
48
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
49
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
50
cp -Pr --no-preserve=ownership "${srcdir}/usr/share/${_pkgname}/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
51
base64 -d "${srcdir}/libquickjs_c_bridge_plugin.so.base64" > "${pkgdir}/usr/lib/${pkgname%-bin}/lib/libquickjs_c_bridge_plugin.so"
52
install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
53
install -Dm644 "${srcdir}/usr/share/icons/hicolor/128x128/apps/${_pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${pkgname%-bin}.png"
54
install -Dm644 "${srcdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-bin}.png"
55
}
56
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 1 |
| 2026-08-02 00:16:08 | MEDIUM | 1 |
| 2026-08-01 00:11:18 | MEDIUM | 1 |
| 2026-07-31 00:14:10 | MEDIUM | 1 |
| 2026-07-30 00:17:23 | MEDIUM | 1 |
| 2026-07-29 00:25:53 | MEDIUM | 1 |
| 2026-07-28 00:07:28 | MEDIUM | 1 |
| 2026-07-27 00:24:32 | MEDIUM | 1 |
| 2026-07-26 00:07:32 | MEDIUM | 1 |
| 2026-07-25 00:13:44 | MEDIUM | 1 |
| 2026-07-24 00:02:28 | MEDIUM | 1 |
| 2026-07-23 00:14:47 | MEDIUM | 1 |
| 2026-07-22 00:29:32 | MEDIUM | 1 |
| 2026-07-21 00:24:15 | MEDIUM | 1 |
| 2026-07-20 00:19:49 | MEDIUM | 1 |
| 2026-07-19 00:17:08 | MEDIUM | 1 |
| 2026-07-18 00:14:48 | MEDIUM | 1 |
| 2026-07-17 00:06:16 | MEDIUM | 1 |
| 2026-07-16 00:05:41 | MEDIUM | 1 |
| 2026-07-15 00:09:25 | MEDIUM | 1 |