hoffice-viewer

maintainer tempuser · 10 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Two real supply-chain concerns exist here. First, the main payload is a prebuilt Debian binary package (hoffice_viewer_2020_amd64.deb) pulled from cdn.hancom.com — this is the official Hancom CDN for their proprietary office suite, so the host itself is legitimate, but it is a closed-source binary blob with no source verification beyond a sha256sum, which is the normal situation for proprietary software packages in the AUR. Second, and more concerning, the package() function performs an additional runtime curl download of a prebuilt shared library (libkime-qt-5.11.3.so) from 'https://github.com/Riey/kime/releases/latest/download/libkime-qt-5.11.3.so' using the 'latest' tag — this means the downloaded binary is NOT pinned to a specific release and has NO checksum verification. A future release of kime could substitute a malicious .so that gets loaded into the Hancom viewer process. This floating 'latest' download of an executed shared library without integrity verification is a genuine medium-severity supply-chain risk, independent of whether the maintainer's intent is benign.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 'https://cdn.hancom.com/pds/hnc/DOWN/gooroom/hoffice_viewer_2020_amd64.deb'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): Two real supply-chain concerns exist here. First, the main payload is a prebuilt Debian binary package (hoffice_viewer_2020_amd64.deb) pulled from cdn.hancom.com — this is the official Hancom CDN for their proprietary office suite, so the host itself is legitimate, but it is a closed-source binary blob with no source verification beyond a sha256sum, which is the normal situation for proprietary software packages in the AUR. Second, and more concerning, the package() function performs an additional runtime curl download of a prebuilt shared library (libkime-qt-5.11.3.so) from 'https://github.com/Riey/kime/releases/latest/download/libkime-qt-5.11.3.so' using the 'latest' tag — this means the downloaded binary is NOT pinned to a specific release and has NO checksum verification. A future release of kime could substitute a malicious .so that gets loaded into the Hancom viewer process. This floating 'latest' download of an executed shared library without integrity verification is a genuine medium-severity supply-chain risk, independent of whether the maintainer's intent is benign.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nobody <>
    
      2
    
      3HNCCONTEXT=opt/hnc/hofficeviewer11/Bin/qt/plugins/platforminputcontexts
    
      4NIMFLIB=libqt5im-nimf.so
    
      5KIMELIB=libkime-qt-5.11.3.so
    
      6
    
      7_referer='Referer: https://www.hancom.com/cs_center'
    
      8DLAGENTS=("https::/usr/bin/curl -# -o %o -H ${_referer// /\\ } %u")
    
      9
    
      10pkgname='hoffice-viewer'
    
      11pkgver=11.20.0.991
    
      12pkgrel=5
    
      13pkgdesc='Office document viewer for Linux'
    
      14arch=('x86_64')
    
      15url='https://www.hancom.com/'
    
      16license=('custom:hoffice-viewer')
    
      17depends=('cairo' 'fontconfig' 'freetype2' 'gcc-libs' 'glibc' 'glu' 'harfbuzz' 'harfbuzz-icu' 'libcups' 'libcurl-gnutls' 'libxcb' 'qt5-base' 'qt5-x11extras' 'zlib')
    
      18
    
      19source=(
    
      20	'https://cdn.hancom.com/pds/hnc/DOWN/gooroom/hoffice_viewer_2020_amd64.deb'
    
      21	'LICENSE'
    
      22	'libqt5im-nimf.so'
    
      23)
    
      24sha256sums=(
    
      25	'db25bfbbe3661625ef3640f619db106f7be9745808277f8a0614f859270dacdd'
    
      26	'f2524728f91bf392edfbc3afce2126c7f0df8e22fc00b798f09e50693cf852e0'
    
      27	'd246c02a20a1e4ea123f9c2275dfc4a2ea091a65032ddbbe8a59bfc71418f60c'
    
      28)
    
      29
    
      30package() {
    
      31	curl -# -o "${srcdir}/${KIMELIB}" -fL 'https://github.com/Riey/kime/releases/latest/download/libkime-qt-5.11.3.so'
    
      32	msg2 "Extracting data.tar.xz..."
    
      33	bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      34	install -Dm644 LICENSE "$pkgdir/usr/share/licenses/hoffice-viewer/LICENSE"
    
      35	if [ -f "${srcdir}/${KIMELIB}" ] && [ -f "${srcdir}/${NIMFLIB}" ]; then
    
      36		install -Dm755 -t "${pkgdir}/${HNCCONTEXT}" "${srcdir}/${KIMELIB}"
    
      37		install -Dm755 -t "${pkgdir}/${HNCCONTEXT}" "${srcdir}/${NIMFLIB}"
    
      38	fi
    
      39	msg2 "The error messages are from UTF-8 limitations. Please ignore it, as it does no harm."
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2