hoffice-viewer

MEDIUM

maintainer tempuser 10 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

Two real supply-chain concerns exist here. First, the main payload is a prebuilt Debian binary package (hoffice_viewer_2020_amd64.deb) pulled from cdn.hancom.com — this is the official Hancom CDN for their proprietary office suite, so the host itself is legitimate, but it is a closed-source binary blob with no source verification beyond a sha256sum, which is the normal situation for proprietary software packages in the AUR. Second, and more concerning, the package() function performs an additional runtime curl download of a prebuilt shared library (libkime-qt-5.11.3.so) from 'https://github.com/Riey/kime/releases/latest/download/libkime-qt-5.11.3.so' using the 'latest' tag — this means the downloaded binary is NOT pinned to a specific release and has NO checksum verification. A future release of kime could substitute a malicious .so that gets loaded into the Hancom viewer process. This floating 'latest' download of an executed shared library without integrity verification is a genuine medium-severity supply-chain risk, independent of whether the maintainer's intent is benign.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 'https://cdn.hancom.com/pds/hnc/DOWN/gooroom/hoffice_viewer_2020_amd64.deb'

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): Two real supply-chain concerns exist here. First, the main payload is a prebuilt Debian binary package (hoffice_viewer_2020_amd64.deb) pulled from cdn.hancom.com — this is the official Hancom CDN for their proprietary office suite, so the host itself is legitimate, but it is a closed-source binary blob with no source verification beyond a sha256sum, which is the normal situation for proprietary software packages in the AUR. Second, and more concerning, the package() function performs an additional runtime curl download of a prebuilt shared library (libkime-qt-5.11.3.so) from 'https://github.com/Riey/kime/releases/latest/download/libkime-qt-5.11.3.so' using the 'latest' tag — this means the downloaded binary is NOT pinned to a specific release and has NO checksum verification. A future release of kime could substitute a malicious .so that gets loaded into the Hancom viewer process. This floating 'latest' download of an executed shared library without integrity verification is a genuine medium-severity supply-chain risk, independent of whether the maintainer's intent is benign.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nobody <>
    
      2
    
      3HNCCONTEXT=opt/hnc/hofficeviewer11/Bin/qt/plugins/platforminputcontexts
    
      4NIMFLIB=libqt5im-nimf.so
    
      5KIMELIB=libkime-qt-5.11.3.so
    
      6
    
      7_referer='Referer: https://www.hancom.com/cs_center'
    
      8DLAGENTS=("https::/usr/bin/curl -# -o %o -H ${_referer// /\\ } %u")
    
      9
    
      10pkgname='hoffice-viewer'
    
      11pkgver=11.20.0.991
    
      12pkgrel=5
    
      13pkgdesc='Office document viewer for Linux'
    
      14arch=('x86_64')
    
      15url='https://www.hancom.com/'
    
      16license=('custom:hoffice-viewer')
    
      17depends=('cairo' 'fontconfig' 'freetype2' 'gcc-libs' 'glibc' 'glu' 'harfbuzz' 'harfbuzz-icu' 'libcups' 'libcurl-gnutls' 'libxcb' 'qt5-base' 'qt5-x11extras' 'zlib')
    
      18
    
      19source=(
    
      20	'https://cdn.hancom.com/pds/hnc/DOWN/gooroom/hoffice_viewer_2020_amd64.deb'
    
      21	'LICENSE'
    
      22	'libqt5im-nimf.so'
    
      23)
    
      24sha256sums=(
    
      25	'db25bfbbe3661625ef3640f619db106f7be9745808277f8a0614f859270dacdd'
    
      26	'f2524728f91bf392edfbc3afce2126c7f0df8e22fc00b798f09e50693cf852e0'
    
      27	'd246c02a20a1e4ea123f9c2275dfc4a2ea091a65032ddbbe8a59bfc71418f60c'
    
      28)
    
      29
    
      30package() {
    
      31	curl -# -o "${srcdir}/${KIMELIB}" -fL 'https://github.com/Riey/kime/releases/latest/download/libkime-qt-5.11.3.so'
    
      32	msg2 "Extracting data.tar.xz..."
    
      33	bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      34	install -Dm644 LICENSE "$pkgdir/usr/share/licenses/hoffice-viewer/LICENSE"
    
      35	if [ -f "${srcdir}/${KIMELIB}" ] && [ -f "${srcdir}/${NIMFLIB}" ]; then
    
      36		install -Dm755 -t "${pkgdir}/${HNCCONTEXT}" "${srcdir}/${KIMELIB}"
    
      37		install -Dm755 -t "${pkgdir}/${HNCCONTEXT}" "${srcdir}/${NIMFLIB}"
    
      38	fi
    
      39	msg2 "The error messages are from UTF-8 limitations. Please ignore it, as it does no harm."
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2