flclash-bin
MEDIUM
maintainer zxp19821005
12 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a base64-encoded binary blob from a personal GitHub Gist, decodes it, and installs it as a shared library, creating a supply-chain risk due to the unverifiable origin and potential for silent replacement.
Triggered rules
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package downloads a base64-encoded binary blob from a personal GitHub Gist, decodes it, and installs it as a shared library, creating a supply-chain risk due to the unverifiable origin and potential for silent replacement.
-
PKGBUILD:33
sha256sums_x86_64=('b24f5aa073952fabfb5b65d67f2800c824fb6a5bce8663524382dc7319d3864c' -
PKGBUILD:34
'367033ae3a8bd11f37e398f38c5de0acd8985b62b93b966eb43648fba6bd9094')
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Dee.H.Y <dongfengweixiao AT hotmail DOT com>
2
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
3
pkgname=flclash-bin
4
_pkgname=FlClash
5
pkgver=0.8.96
6
pkgrel=2
7
pkgdesc="A multi-platform proxy client based on ClashMeta,simple and easy to use, open-source and ad-free."
8
arch=(
9
#'aarch64'
10
'x86_64'
11
)
12
url="https://github.com/chen08209/FlClash"
13
license=('GPL-3.0-only')
14
conflicts=("${pkgname%-bin}")
15
provides=("${pkgname%-bin}=${pkgver}")
16
depends=(
17
'libayatana-appindicator'
18
'ayatana-ido'
19
'libdbusmenu-glib'
20
'libkeybinder3'
21
'libayatana-indicator'
22
'libappindicator'
23
)
24
source=(
25
"${pkgname%-bin}.sh"
26
)
27
#source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64.deb")
28
source_x86_64=(
29
"${pkgname%-bin}-${pkgver}-x86_64.deb::${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-amd64.deb"
30
"libquickjs_c_bridge_plugin.so.base64::https://gist.githubusercontent.com/dongfengweixiao/bbddee34d6456326200fac3463761296/raw/c18484d78449d0e3b376a6e2a49852486305ff1e/libquickjs_c_bridge_plugin.so.base64"
31
)
32
sha256sums=('3b8311438e88f47eb507322a43c7a4156bfebb8c0f6e7b7436ef70842fb4c745')
33
sha256sums_x86_64=('b24f5aa073952fabfb5b65d67f2800c824fb6a5bce8663524382dc7319d3864c'
34
'367033ae3a8bd11f37e398f38c5de0acd8985b62b93b966eb43648fba6bd9094')
35
# sha256sums_aarch64=('b250a118058cadd5d3dde417f38c439c5d535ae0597a145be235d6cdcbf4e325')
36
prepare() {
37
sed -i -e "
38
s/@appname@/${pkgname%-bin}/g
39
s/@runname@/${_pkgname}/g
40
" "${srcdir}/${pkgname%-bin}.sh"
41
bsdtar -xf "${srcdir}/data."*
42
sed -i -e "
43
s/Exec=${_pkgname}/Exec=${pkgname%-bin}/g
44
s/Icon=${_pkgname}/Icon=${pkgname%-bin}/g
45
5i\Categories=Network;
46
10i\StartupWMClass=com.follow.clash
47
" "${srcdir}/usr/share/applications/${_pkgname}.desktop"
48
}
49
package() {
50
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
51
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
52
cp -a "${srcdir}/usr/share/${_pkgname}/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
53
base64 -d "${srcdir}/libquickjs_c_bridge_plugin.so.base64" > "${pkgdir}/usr/lib/${pkgname%-bin}/lib/libquickjs_c_bridge_plugin.so"
54
install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
55
find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
56
_extension="${_i##*.}"
57
_icon_path="${_i#*share/icons/}"
58
_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
59
install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
60
done
61
}
62
Changes since previous scan
--- PKGBUILD @ 2026-09-10 00:22+++ PKGBUILD @ 2026-09-17 00:27@@ -3,7 +3,7 @@ pkgname=flclash-bin _pkgname=FlClash pkgver=0.8.96-pkgrel=1+pkgrel=2 pkgdesc="A multi-platform proxy client based on ClashMeta,simple and easy to use, open-source and ad-free." arch=( #'aarch64'@@ -18,6 +18,8 @@ 'ayatana-ido' 'libdbusmenu-glib' 'libkeybinder3'+ 'libayatana-indicator'+ 'libappindicator' ) source=( "${pkgname%-bin}.sh"@@ -57,3 +59,4 @@ install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}" done }+Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 1 |
| 2026-09-16 00:03:17 | Medium | 1 |
| 2026-09-15 00:25:31 | Medium | 1 |
| 2026-09-14 00:27:57 | Medium | 1 |
| 2026-09-13 00:19:54 | Medium | 1 |
| 2026-09-12 00:25:17 | Medium | 1 |
| 2026-09-11 00:19:22 | Medium | 1 |
| 2026-09-10 09:20:32 | Medium | 1 |
| 2026-09-10 00:22:44 | Medium | 1 |
| 2026-09-09 00:04:09 | Medium | 1 |
| 2026-09-08 00:18:08 | Medium | 1 |
| 2026-09-07 09:14:05 | Medium | 1 |
| 2026-09-07 00:30:15 | Medium | 1 |
| 2026-09-06 00:17:06 | Medium | 1 |
| 2026-09-05 00:16:27 | Medium | 1 |
| 2026-09-04 00:03:13 | Medium | 1 |
| 2026-09-03 00:15:47 | Medium | 1 |
| 2026-09-02 00:02:31 | Medium | 1 |
| 2026-09-01 00:11:19 | Medium | 1 |
| 2026-08-31 00:19:57 | Medium | 1 |