flclash-myflavor-bin
maintainer illusory
· 1 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt .deb binary from a GitHub release via a proxy domain (gh-proxy.com), which is an unverifiable, third-party host that could silently serve modified content, constituting a supply-chain risk.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
"${pkgname%-bin}-${pkgver}-x86_64.deb::https://gh-proxy.com/${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-amd64.deb"
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a GitHub release via a proxy domain (gh-proxy.com), which is an unverifiable, third-party host that could silently serve modified content, constituting a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: illusory <becomeillusory AT gmail DOT com>
2
3
4
pkgname=flclash-myflavor-bin
5
_pkgname=FlClash
6
pkgver=1.19.28
7
pkgrel=1
8
pkgdesc="Multi-platform proxy client based on ClashMeta, simple and easy to use, open-source and ad-free, follows the mainline mihomo core updates. (Forked by myflavor)"
9
arch=('x86_64')
10
url="https://github.com/myflavor/FlClash"
11
license=('GPL-3.0-only')
12
conflicts=("${pkgname%-bin}")
13
provides=("${pkgname%-bin}=${pkgver}")
14
15
depends=(
16
'libayatana-appindicator'
17
'ayatana-ido'
18
'libdbusmenu-glib'
19
'libkeybinder3'
20
)
21
22
23
source=(
24
"${pkgname%-bin}.sh"
25
)
26
27
28
source_x86_64=(
29
"${pkgname%-bin}-${pkgver}-x86_64.deb::https://gh-proxy.com/${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-amd64.deb"
30
)
31
32
33
sha256sums=('debddc0c8728bcbc552d0826ef0b5a4cd33e20df01752baa85e54498ec8ec3d5')
34
sha256sums_x86_64=('d361c18d65eee884d785331ac0a94ed0bd4a57beac6911e78fc5241d85e2acf8')
35
36
prepare() {
37
sed -i -e "
38
s/@appname@/${pkgname%-bin}/g
39
s/@runname@/${_pkgname}/g
40
" "${srcdir}/${pkgname%-bin}.sh"
41
bsdtar -xf "${srcdir}/data."*
42
sed -i -e "
43
s/Exec=${_pkgname}/Exec=${pkgname%-bin}/g
44
s/Icon=${_pkgname}/Icon=${pkgname%-bin}/g
45
5i\Categories=Network;
46
10i\StartupWMClass=com.follow.clash
47
" "${srcdir}/usr/share/applications/${_pkgname}.desktop"
48
}
49
package() {
50
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
51
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
52
cp -Pr --no-preserve=ownership "${srcdir}/usr/share/${_pkgname}/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
53
install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
54
install -Dm644 "${srcdir}/usr/share/icons/hicolor/128x128/apps/${_pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${pkgname%-bin}.png"
55
install -Dm644 "${srcdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-bin}.png"
56
}
57
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |