hayase-desktop-bin

MEDIUM

maintainer Duwangel 20 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted, project-unrelated domain (api.hayase.watch), which presents a supply-chain risk as the binary artifact is not built from source and could be silently replaced.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "${pkgname%-desktop-bin}-${pkgver}.deb::https://api.hayase.watch/files/linux-${pkgname%-desktop-bin}-${pkgver}-linux.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-whitelisted, project-unrelated domain (api.hayase.watch), which presents a supply-chain risk as the binary artifact is not built from source and could be silently replaced.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Duwangel <duwangelwj@pm.me>
    
      2# Contributor: Look <notkool@protonmail.com>
    
      3# Contributor: hyknn <hyknn@protonmail.com>
    
      4pkgname=hayase-desktop-bin
    
      5_pkgname=Hayase
    
      6pkgver=6.4.86
    
      7pkgrel=1
    
      8pkgdesc="Torrent streaming made simple. Watch anime torrents, real-time with no waiting for downloads (prebuilt binary), successor to miru-bin"
    
      9arch=('x86_64')
    
      10url="https://github.com/hayase-app"
    
      11license=('BUSL-1.1')
    
      12depends=('xdg-utils')
    
      13provides=(
    
      14    "${pkgname%-desktop-bin}"
    
      15    'miru'
    
      16)
    
      17conflicts=("${pkgname%-desktop-bin}")
    
      18options=(
    
      19    '!strip'
    
      20    '!emptydirs'
    
      21    '!debug'
    
      22)
    
      23install=${pkgname}.install
    
      24source=(
    
      25    "${pkgname%-desktop-bin}-${pkgver}.deb::https://api.hayase.watch/files/linux-${pkgname%-desktop-bin}-${pkgver}-linux.deb"
    
      26    "LICENSE-${pkgver}::https://raw.githubusercontent.com/hayase-app/electron/main/LICENSE"
    
      27    "${pkgname}.install"
    
      28)
    
      29sha512sums=('0a2b03edf586287e000a7f9830e27a4aa6f406b72d7d7597a0f6098f4929d01dc594455ea573bd488266d8c259f08df5274908db24562b46fb59cc5e10228ba3'
    
      30            '28eb0f95d44512e9b901dbcf6c75d9d1fd21d60728d0958f3936f7071a16d62b4999470462b637fc5ba4a35b5fe99838510289f8ba017255e0f13a8dad2e9f29'
    
      31            '67b9bf7da2fc891442b8bfd441a12203717c1f9e96ef94eae62c53138b4e4442b26da9ad4a41a40f79de5f5c93383e092db3629e249c9a04e3f24c415a6a1ba1')
    
      32
    
      33package() {
    
      34    # Extract package data
    
      35    tar -xJ -f data.tar.xz -C "${pkgdir}"
    
      36
    
      37    install -D -m644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2