helium-widevine

LOW

maintainer dizziee 0 votes scanned 2026-10-18 05:23:06.878888

View on AUR

Why flagged

Downloads Widevine CDM directly from Google's official distribution endpoint (www.google.com/dl/release2/chrome_component) with a sha256 checksum; the .so is a prebuilt binary but sourced from Google's own infrastructure, making silent substitution unlikely, though it targets a niche browser and has few votes.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads Widevine CDM directly from Google's official distribution endpoint (www.google.com/dl/release2/chrome_component) with a sha256 checksum; the .so is a prebuilt binary but sourced from Google's own infrastructure, making silent substitution unlikely, though it targets a niche browser and has few votes.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://www.google.com/dl/release2/chrome_component/${_release_id}_${pkgver}/oimompecagnajdejgnnjijobebaeigek_${pkgver}_linux_${_file_id}.crx3")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: JJDizz1L <jjdizz1l@proton.me>
    
      2# Contributor: maryext <me@mary.my.id>
    
      3
    
      4pkgname=helium-widevine
    
      5pkgdesc='A browser plugin designed for the viewing of premium video content (for Helium Browser)'
    
      6pkgver=4.10.3050.0
    
      7_release_id=bywu6vkyg6gmcthxdaetzfkptm
    
      8_file_id=aduyhcxcs7a2znuo6ss5tffn5jpa
    
      9pkgrel=1
    
      10epoch=1
    
      11arch=('x86_64')
    
      12url='https://www.widevine.com/'
    
      13license=('custom')
    
      14options=('!strip')
    
      15depends=('gcc-libs' 'glib2' 'glibc' 'nspr' 'nss' 'helium-browser-bin')
    
      16source=("https://www.google.com/dl/release2/chrome_component/${_release_id}_${pkgver}/oimompecagnajdejgnnjijobebaeigek_${pkgver}_linux_${_file_id}.crx3")
    
      17sha256sums=('b70d887771d663018f46b1072b14320bd8b9a763641ef0317bd979cbad443e88')
    
      18
    
      19package() {
    
      20  install -Dm755 "${srcdir}/_platform_specific/linux_x64/libwidevinecdm.so" \
    
      21    "${pkgdir}/opt/helium-browser-bin/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so"
    
      22  install -Dm644 "${srcdir}/manifest.json" \
    
      23    "${pkgdir}/opt/helium-browser-bin/WidevineCdm/manifest.json"
    
      24  install -Dm644 "${srcdir}/LICENSE" \
    
      25    "${pkgdir}/opt/helium-browser-bin/WidevineCdm/LICENSE"
    
      26  install -Dm644 "${srcdir}/LICENSE" \
    
      27    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      28
    
      29  # backward compatibility
    
      30  ln -s WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so "$pkgdir/opt/helium-browser-bin/libwidevinecdm.so"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 05:23:06	Low	3
2026-10-18 05:21:06	Medium	3