hexhub-new
maintainer maxmeieran
· 1 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
Installs a prebuilt binary .deb from oss.hexhub.cn (a CDN/object-storage host associated with the project but not a well-known forge), which is unverifiable beyond the provided checksum; the package extracts and installs the binary directly without any build step, so a swapped artifact would silently replace the installed executable, though the sha256 checksum does provide some integrity guarantee.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:12
source=("HexHub-Client-linux-amd64-deb-${pkgver}-${_pkgdate}.deb::https://oss.hexhub.cn/plugin/HexHub-Client-linux-amd64-deb-${pkgver}-${_pkgdate}.deb")
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary .deb from oss.hexhub.cn (a CDN/object-storage host associated with the project but not a well-known forge), which is unverifiable beyond the provided checksum; the package extracts and installs the binary directly without any build step, so a swapped artifact would silently replace the installed executable, though the sha256 checksum does provide some integrity guarantee.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: mineleng <15119587808@163.com>
2
pkgname=hexhub-new
3
pkgver=5.1.9
4
pkgrel=1
5
pkgdesc="database, docker, ssh, sftp. all in one"
6
arch=('x86_64')
7
url="https://hexhub.cn"
8
license=('GPL')
9
depends=()
10
provides=('HexHub')
11
_pkgdate=202606072154
12
source=("HexHub-Client-linux-amd64-deb-${pkgver}-${_pkgdate}.deb::https://oss.hexhub.cn/plugin/HexHub-Client-linux-amd64-deb-${pkgver}-${_pkgdate}.deb")
13
sha256sums=('2acb2b03817bbd66a7072f912c570546f19ab0472b9b7da4af5ffff17512857c')
14
15
package() {
16
bsdtar -xf "${srcdir}/HexHub-Client-linux-amd64-deb-${pkgver}-${_pkgdate}.deb" -C "${srcdir}" data.tar.xz
17
bsdtar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}"
18
}
19
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 3 |
| 2026-07-27 00:24:32 | MEDIUM | 3 |
| 2026-07-26 00:07:32 | MEDIUM | 3 |
| 2026-07-25 00:13:44 | MEDIUM | 3 |
| 2026-07-24 00:02:28 | MEDIUM | 3 |
| 2026-07-23 00:14:47 | MEDIUM | 3 |
| 2026-07-22 00:29:32 | MEDIUM | 3 |
| 2026-07-21 00:24:15 | MEDIUM | 3 |
| 2026-07-20 00:19:49 | MEDIUM | 3 |
| 2026-07-19 00:17:08 | MEDIUM | 3 |
| 2026-07-18 00:14:48 | MEDIUM | 3 |
| 2026-07-17 00:06:16 | MEDIUM | 3 |
| 2026-07-16 00:05:41 | MEDIUM | 3 |
| 2026-07-15 00:09:25 | MEDIUM | 3 |