hayase-desktop-bin

maintainer Duwangel · 20 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-whitelisted, project-unrelated domain (api.hayase.watch), which presents a supply-chain risk as the binary artifact is not built from source and could be silently replaced.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "${pkgname%-desktop-bin}-${pkgver}.deb::https://api.hayase.watch/files/linux-${pkgname%-desktop-bin}-${pkgver}-linux.deb"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-whitelisted, project-unrelated domain (api.hayase.watch), which presents a supply-chain risk as the binary artifact is not built from source and could be silently replaced.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Duwangel <duwangelwj@pm.me>
    
      2# Contributor: Look <notkool@protonmail.com>
    
      3# Contributor: hyknn <hyknn@protonmail.com>
    
      4pkgname=hayase-desktop-bin
    
      5_pkgname=Hayase
    
      6pkgver=6.4.86
    
      7pkgrel=1
    
      8pkgdesc="Torrent streaming made simple. Watch anime torrents, real-time with no waiting for downloads (prebuilt binary), successor to miru-bin"
    
      9arch=('x86_64')
    
      10url="https://github.com/hayase-app"
    
      11license=('BUSL-1.1')
    
      12depends=('xdg-utils')
    
      13provides=(
    
      14    "${pkgname%-desktop-bin}"
    
      15    'miru'
    
      16)
    
      17conflicts=("${pkgname%-desktop-bin}")
    
      18options=(
    
      19    '!strip'
    
      20    '!emptydirs'
    
      21    '!debug'
    
      22)
    
      23install=${pkgname}.install
    
      24source=(
    
      25    "${pkgname%-desktop-bin}-${pkgver}.deb::https://api.hayase.watch/files/linux-${pkgname%-desktop-bin}-${pkgver}-linux.deb"
    
      26    "LICENSE-${pkgver}::https://raw.githubusercontent.com/hayase-app/electron/main/LICENSE"
    
      27    "${pkgname}.install"
    
      28)
    
      29sha512sums=('0a2b03edf586287e000a7f9830e27a4aa6f406b72d7d7597a0f6098f4929d01dc594455ea573bd488266d8c259f08df5274908db24562b46fb59cc5e10228ba3'
    
      30            '28eb0f95d44512e9b901dbcf6c75d9d1fd21d60728d0958f3936f7071a16d62b4999470462b637fc5ba4a35b5fe99838510289f8ba017255e0f13a8dad2e9f29'
    
      31            '67b9bf7da2fc891442b8bfd441a12203717c1f9e96ef94eae62c53138b4e4442b26da9ad4a41a40f79de5f5c93383e092db3629e249c9a04e3f24c415a6a1ba1')
    
      32
    
      33package() {
    
      34    # Extract package data
    
      35    tar -xJ -f data.tar.xz -C "${pkgdir}"
    
      36
    
      37    install -D -m644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      38}
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 # Contributor: hyknn <hyknn@protonmail.com>
 pkgname=hayase-desktop-bin
 _pkgname=Hayase
-pkgver=6.4.85
+pkgver=6.4.86
 pkgrel=1
 pkgdesc="Torrent streaming made simple. Watch anime torrents, real-time with no waiting for downloads (prebuilt binary), successor to miru-bin"
 arch=('x86_64')
@@ -26,7 +26,7 @@
     "LICENSE-${pkgver}::https://raw.githubusercontent.com/hayase-app/electron/main/LICENSE"
     "${pkgname}.install"
 )
-sha512sums=('7f261b91ab06d7e9d24736ea6ea66289c757af24bfa46e2aedb668cef76e2bea562add19f62d4f916e7b9ae7b31aa8c4371c0c1eb6c463e95038f34f28c198b4'
+sha512sums=('0a2b03edf586287e000a7f9830e27a4aa6f406b72d7d7597a0f6098f4929d01dc594455ea573bd488266d8c259f08df5274908db24562b46fb59cc5e10228ba3'
             '28eb0f95d44512e9b901dbcf6c75d9d1fd21d60728d0958f3936f7071a16d62b4999470462b637fc5ba4a35b5fe99838510289f8ba017255e0f13a8dad2e9f29'
             '67b9bf7da2fc891442b8bfd441a12203717c1f9e96ef94eae62c53138b4e4442b26da9ad4a41a40f79de5f5c93383e092db3629e249c9a04e3f24c415a6a1ba1')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 17:39:33	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 19:21:42	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 09:16:42	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2