hydrogen-music-bin

maintainer ldx123000 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt AppImage from the project's GitHub releases, which is a common but less ideal practice; however, it is not inherently malicious, and the source is from the maintainer's official repository with verifiable checksums.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt AppImage from the project's GitHub releases, which is a common but less ideal practice; however, it is not inherently malicious, and the source is from the maintainer's official repository with verifiable checksums.

PKGBUILD

      1# SPDX-License-Identifier: 0BSD
    
      2# Maintainer: ldx123000 <ldx123000@gmail.com>
    
      3
    
      4pkgname=hydrogen-music-bin
    
      5_pkgname=hydrogen-music
    
      6pkgver=0.6.2
    
      7pkgrel=1
    
      8pkgdesc='Arknights-style third-party NetEase Cloud Music player built with Electron and Vue 3'
    
      9arch=('x86_64')
    
      10url='https://github.com/ldx123000/Hydrogen-Music'
    
      11license=('MIT')
    
      12depends=('alsa-lib' 'at-spi2-core' 'fuse2' 'glibc' 'gtk3' 'libnotify' 'libsecret' 'libxss' 'libxtst' 'nss' 'util-linux-libs' 'xdg-utils')
    
      13optdepends=('libappindicator: system tray support')
    
      14provides=('hydrogen-music')
    
      15conflicts=('hydrogen-music')
    
      16options=('!strip')
    
      17source=(
    
      18  "${_pkgname}-${pkgver}.AppImage::${url}/releases/download/v${pkgver}/Hydrogen.Music-${pkgver}.AppImage"
    
      19  "${_pkgname}.png::https://raw.githubusercontent.com/ldx123000/Hydrogen-Music/v${pkgver}/img/icon.png"
    
      20  "${_pkgname}-LICENSE::https://raw.githubusercontent.com/ldx123000/Hydrogen-Music/v${pkgver}/LICENSE"
    
      21)
    
      22noextract=("${_pkgname}-${pkgver}.AppImage")
    
      23sha256sums=(
    
      24  'eedf74f9e597a4391af2952fa1fecc6f0ef8810a772cbe14caf2bcd7f0cd2d0e'
    
      25  'e942d5307c7690a86826828212bbabbc13b17e13879d828b4a06b73c34cf0025'
    
      26  '0d63d1741e2c23866af592ac48a93f986a386575f90ffff2c67add4633db04e6'
    
      27)
    
      28
    
      29package() {
    
      30  install -Dm755 "${srcdir}/${_pkgname}-${pkgver}.AppImage" "${pkgdir}/opt/${_pkgname}/${_pkgname}.AppImage"
    
      31  install -Dm644 "${srcdir}/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      32  install -Dm644 "${srcdir}/${_pkgname}-LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      33
    
      34  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${_pkgname}" <<'EOF'
    
      35#!/bin/sh
    
      36exec /opt/hydrogen-music/hydrogen-music.AppImage "$@"
    
      37EOF
    
      38
    
      39  install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${_pkgname}.desktop" <<EOF
    
      40[Desktop Entry]
    
      41Name=Hydrogen Music
    
      42Comment=Arknights-style third-party NetEase Cloud Music player
    
      43Exec=/usr/bin/${_pkgname} %U
    
      44Terminal=false
    
      45Type=Application
    
      46Icon=${_pkgname}
    
      47StartupWMClass=Hydrogen Music
    
      48Categories=Audio;Music;Player;
    
      49EOF
    
      50}
    
      51

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 
 pkgname=hydrogen-music-bin
 _pkgname=hydrogen-music
-pkgver=0.6.1
+pkgver=0.6.2
 pkgrel=1
 pkgdesc='Arknights-style third-party NetEase Cloud Music player built with Electron and Vue 3'
 arch=('x86_64')
@@ -21,7 +21,7 @@
 )
 noextract=("${_pkgname}-${pkgver}.AppImage")
 sha256sums=(
-  'e46e026e50e1efc4a18b91fc832cde7dcc3f2a00df5736d8bd78067937b106e9'
+  'eedf74f9e597a4391af2952fa1fecc6f0ef8810a772cbe14caf2bcd7f0cd2d0e'
   'e942d5307c7690a86826828212bbabbc13b17e13879d828b4a06b73c34cf0025'
   '0d63d1741e2c23866af592ac48a93f986a386575f90ffff2c67add4633db04e6'
 )

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	LOW	2
2026-07-30 15:15:12	LOW	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 07:13:42	MEDIUM	2