flclash-bin

maintainer zxp19821005 · 12 votes · scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged The package downloads a base64-encoded binary blob (libquickjs_c_bridge_plugin.so) from a personal GitHub Gist, decodes it, and installs it as a shared library; this constitutes an unverifiable prebuilt executable from a swappable host, creating a supply-chain risk.

Triggered rules

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a base64-encoded binary blob (libquickjs_c_bridge_plugin.so) from a personal GitHub Gist, decodes it, and installs it as a shared library; this constitutes an unverifiable prebuilt executable from a swappable host, creating a supply-chain risk.

  • PKGBUILD:31 sha256sums_x86_64=('e3d7ad04d6918cbe40d69a146c214ab3674cfb8ce4494d6ab5ae5d8105fea643'
  • PKGBUILD:32 '367033ae3a8bd11f37e398f38c5de0acd8985b62b93b966eb43648fba6bd9094')

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: Dee.H.Y <dongfengweixiao AT hotmail DOT com>
2# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
3pkgname=flclash-bin
4_pkgname=FlClash
5pkgver=0.8.94
6pkgrel=1
7pkgdesc="A multi-platform proxy client based on ClashMeta,simple and easy to use, open-source and ad-free."
8arch=(
9 #'aarch64'
10 'x86_64'
11)
12url="https://github.com/chen08209/FlClash"
13license=('GPL-3.0-only')
14conflicts=("${pkgname%-bin}")
15provides=("${pkgname%-bin}=${pkgver}")
16depends=(
17 'libayatana-appindicator'
18 'ayatana-ido'
19 'libdbusmenu-glib'
20 'libkeybinder3'
21)
22source=(
23 "${pkgname%-bin}.sh"
24)
25#source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64.deb")
26source_x86_64=(
27 "${pkgname%-bin}-${pkgver}-x86_64.deb::${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-amd64.deb"
28 "libquickjs_c_bridge_plugin.so.base64::https://gist.githubusercontent.com/dongfengweixiao/bbddee34d6456326200fac3463761296/raw/c18484d78449d0e3b376a6e2a49852486305ff1e/libquickjs_c_bridge_plugin.so.base64"
29)
30sha256sums=('3b8311438e88f47eb507322a43c7a4156bfebb8c0f6e7b7436ef70842fb4c745')
31sha256sums_x86_64=('e3d7ad04d6918cbe40d69a146c214ab3674cfb8ce4494d6ab5ae5d8105fea643'
32 '367033ae3a8bd11f37e398f38c5de0acd8985b62b93b966eb43648fba6bd9094')
33# sha256sums_aarch64=('b250a118058cadd5d3dde417f38c439c5d535ae0597a145be235d6cdcbf4e325')
34prepare() {
35 sed -i -e "
36 s/@appname@/${pkgname%-bin}/g
37 s/@runname@/${_pkgname}/g
38 " "${srcdir}/${pkgname%-bin}.sh"
39 bsdtar -xf "${srcdir}/data."*
40 sed -i -e "
41 s/Exec=${_pkgname}/Exec=${pkgname%-bin}/g
42 s/Icon=${_pkgname}/Icon=${pkgname%-bin}/g
43 5i\Categories=Network;
44 10i\StartupWMClass=com.follow.clash
45 " "${srcdir}/usr/share/applications/${_pkgname}.desktop"
46}
47package() {
48 install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
49 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
50 cp -Pr --no-preserve=ownership "${srcdir}/usr/share/${_pkgname}/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
51 base64 -d "${srcdir}/libquickjs_c_bridge_plugin.so.base64" > "${pkgdir}/usr/lib/${pkgname%-bin}/lib/libquickjs_c_bridge_plugin.so"
52 install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
53 install -Dm644 "${srcdir}/usr/share/icons/hicolor/128x128/apps/${_pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${pkgname%-bin}.png"
54 install -Dm644 "${srcdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-bin}.png"
55}
56

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 MEDIUM 1
2026-08-02 00:16:08 MEDIUM 1
2026-08-01 00:11:18 MEDIUM 1
2026-07-31 00:14:10 MEDIUM 1
2026-07-30 00:17:23 MEDIUM 1
2026-07-29 00:25:53 MEDIUM 1
2026-07-28 00:07:28 MEDIUM 1
2026-07-27 00:24:32 MEDIUM 1
2026-07-26 00:07:32 MEDIUM 1
2026-07-25 00:13:44 MEDIUM 1
2026-07-24 00:02:28 MEDIUM 1
2026-07-23 00:14:47 MEDIUM 1
2026-07-22 00:29:32 MEDIUM 1
2026-07-21 00:24:15 MEDIUM 1
2026-07-20 00:19:49 MEDIUM 1
2026-07-19 00:17:08 MEDIUM 1
2026-07-18 00:14:48 MEDIUM 1
2026-07-17 00:06:16 MEDIUM 1
2026-07-16 00:05:41 MEDIUM 1
2026-07-15 00:09:25 MEDIUM 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion