flclash-oixcloud

MEDIUM

maintainer JayceCao 0 votes scanned 2026-10-27 17:50:47.810903

View on AUR

Why flagged

Downloads a prebuilt .deb binary from 'dl.dler.io', a non-official host unrelated to the upstream FlClash project, which could silently serve a swapped executable; the package is a custom/unofficial build with few votes, making supply-chain substitution a realistic concern.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "${pkgname}-${pkgver}.deb::https://dl.dler.io/flclash-linux-amd64.deb"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Downloads a prebuilt .deb binary from 'dl.dler.io', a non-official host unrelated to the upstream FlClash project, which could silently serve a swapped executable; the package is a custom/unofficial build with few votes, making supply-chain substitution a realistic concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nitro Cao <nitro@oixcloud.com>
    
      2pkgname=flclash-oixcloud
    
      3pkgver=0.9.2+2026102712
    
      4pkgrel=1
    
      5pkgdesc="A multi-platform proxy client based on ClashMeta, simple and easy to use, open-source and ad-free (oixcloud custom build)"
    
      6arch=('x86_64')
    
      7url="https://oixcloud.com"
    
      8license=('GPL-3.0-only')
    
      9options=('!strip')
    
      10depends=(
    
      11    'libayatana-appindicator'
    
      12    'libayatana-indicator'
    
      13    'ayatana-ido'
    
      14    'libdbusmenu-glib'
    
      15    'libsecret'
    
      16)
    
      17source=(
    
      18    "${pkgname}.sh"
    
      19    "${pkgname}-${pkgver}.deb::https://dl.dler.io/flclash-linux-amd64.deb"
    
      20)
    
      21sha256sums=(
    
      22    'f6577f73105a095767c9fc645ce4ab9e1436138685b981feb4e17f9c87eca9a1'
    
      23    '5b751daa3f6a79035766506ac2535a242ffa7464696e5c6811ef6d6eee7a8725'
    
      24)
    
      25
    
      26prepare() {
    
      27    bsdtar -xf "${srcdir}/${pkgname}-${pkgver}.deb"
    
      28    bsdtar -xf "${srcdir}/data."*
    
      29}
    
      30
    
      31package() {
    
      32    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      33
    
      34    install -dm755 "${pkgdir}/opt/${pkgname}"
    
      35    cp -Pr --no-preserve=ownership "${srcdir}/usr/share/${pkgname}/"* "${pkgdir}/opt/${pkgname}/"
    
      36
    
      37    install -Dm644 "${srcdir}/usr/share/applications/${pkgname}.desktop" \
    
      38        "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      39
    
      40    for size in 128 256; do
    
      41        install -Dm644 "${srcdir}/usr/share/icons/hicolor/${size}x${size}/apps/${pkgname}.png" \
    
      42            "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/${pkgname}.png"
    
      43    done
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 17:50:47	Medium	3
2026-10-27 17:48:24	Medium	3