hayase-desktop-bin

MEDIUM

maintainer Duwangel 20 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard host (api.hayase.watch), which is not a widely recognized or trusted distribution platform, creating a supply-chain risk if the host is compromised or malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "${pkgname%-desktop-bin}-${pkgver}.deb::https://api.hayase.watch/files/linux-${pkgname%-desktop-bin}-${pkgver}-linux.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard host (api.hayase.watch), which is not a widely recognized or trusted distribution platform, creating a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Duwangel <duwangelwj@pm.me>
    
      2# Contributor: Look <notkool@protonmail.com>
    
      3# Contributor: hyknn <hyknn@protonmail.com>
    
      4pkgname=hayase-desktop-bin
    
      5_pkgname=Hayase
    
      6pkgver=6.5.8
    
      7pkgrel=1
    
      8pkgdesc="Torrent streaming made simple. Watch anime torrents, real-time with no waiting for downloads (prebuilt binary), successor to miru-bin"
    
      9arch=('x86_64')
    
      10url="https://github.com/hayase-app"
    
      11license=('BUSL-1.1')
    
      12depends=('xdg-utils')
    
      13provides=(
    
      14    "${pkgname%-desktop-bin}"
    
      15    'miru'
    
      16)
    
      17conflicts=("${pkgname%-desktop-bin}")
    
      18options=(
    
      19    '!strip'
    
      20    '!emptydirs'
    
      21    '!debug'
    
      22)
    
      23install=${pkgname}.install
    
      24source=(
    
      25    "${pkgname%-desktop-bin}-${pkgver}.deb::https://api.hayase.watch/files/linux-${pkgname%-desktop-bin}-${pkgver}-linux.deb"
    
      26    "LICENSE-${pkgver}::https://raw.githubusercontent.com/hayase-app/electron/main/LICENSE"
    
      27    "${pkgname}.install"
    
      28)
    
      29sha512sums=('3781819313ce3e2aa5a769c0d484d02ec7e9e121a3aa22c446db8cafe1f706d4c8a3068ca474073427a4e4bef59e322e2addbd7ef5b6c66ae9c3782abbf02c0f'
    
      30            '28eb0f95d44512e9b901dbcf6c75d9d1fd21d60728d0958f3936f7071a16d62b4999470462b637fc5ba4a35b5fe99838510289f8ba017255e0f13a8dad2e9f29'
    
      31            '67b9bf7da2fc891442b8bfd441a12203717c1f9e96ef94eae62c53138b4e4442b26da9ad4a41a40f79de5f5c93383e092db3629e249c9a04e3f24c415a6a1ba1')
    
      32
    
      33package() {
    
      34    # Extract package data
    
      35    tar -xJ -f data.tar.xz -C "${pkgdir}"
    
      36
    
      37    install -D -m644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      38}
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-10-24 00:14
+++ PKGBUILD @ 2026-11-01 00:21
@@ -3,7 +3,7 @@
 # Contributor: hyknn <hyknn@protonmail.com>
 pkgname=hayase-desktop-bin
 _pkgname=Hayase
-pkgver=6.4.86
+pkgver=6.5.8
 pkgrel=1
 pkgdesc="Torrent streaming made simple. Watch anime torrents, real-time with no waiting for downloads (prebuilt binary), successor to miru-bin"
 arch=('x86_64')
@@ -26,7 +26,7 @@
     "LICENSE-${pkgver}::https://raw.githubusercontent.com/hayase-app/electron/main/LICENSE"
     "${pkgname}.install"
 )
-sha512sums=('0a2b03edf586287e000a7f9830e27a4aa6f406b72d7d7597a0f6098f4929d01dc594455ea573bd488266d8c259f08df5274908db24562b46fb59cc5e10228ba3'
+sha512sums=('3781819313ce3e2aa5a769c0d484d02ec7e9e121a3aa22c446db8cafe1f706d4c8a3068ca474073427a4e4bef59e322e2addbd7ef5b6c66ae9c3782abbf02c0f'
             '28eb0f95d44512e9b901dbcf6c75d9d1fd21d60728d0958f3936f7071a16d62b4999470462b637fc5ba4a35b5fe99838510289f8ba017255e0f13a8dad2e9f29'
             '67b9bf7da2fc891442b8bfd441a12203717c1f9e96ef94eae62c53138b4e4442b26da9ad4a41a40f79de5f5c93383e092db3629e249c9a04e3f24c415a6a1ba1')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 07:39:45	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2