hyphenbox-bin

MEDIUM

maintainer zxp19821005 0 votes scanned 2026-09-08 07:16:32.151301

View on AUR

Why flagged

The package installs a prebuilt binary from a non-whitelisted but plausibly project-owned GitHub release; while the source is verifiable via checksum, the binary could pose a supply-chain risk if the host were compromised, though no active malicious behavior is evident.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt binary from a non-whitelisted but plausibly project-owned GitHub release; while the source is verifiable via checksum, the binary could pose a supply-chain risk if the host were compromised, though no active malicious behavior is evident.

PKGBUILD

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=hyphenbox-bin
    
      3_pkgname=HyphenBox
    
      4_zhsname='黑粉盒子'
    
      5pkgver=0.4.63
    
      6pkgrel=1
    
      7pkgdesc="Free large model API radar + local unified routing. Includes 103 free APIs to measure which ones are still alive; your Key only exists on your own computer, and a local interface is connected to Cursor/Cline/OpenCode."
    
      8arch=('x86_64')
    
      9url="https://github.com/HackerChi-Hub/hyphenbox-release"
    
      10license=('LicenseRef-custom')
    
      11provides=("${pkgname%-bin}=${pkgver}")
    
      12conflicts=("${pkgname%-bin}")
    
      13depends=(
    
      14    'gtk3'
    
      15    'gdk-pixbuf2'
    
      16    'webkit2gtk-4.1'
    
      17)
    
      18source=(
    
      19    "${pkgname%-bin}-${pkgver}.deb::${url}/releases/download/v${pkgver}/${_pkgname}_${pkgver}_amd64.deb"
    
      20    "LICENSE-${pkgver}::${url}/blob/v${pkgver}/LICENSE_PENDING.md"
    
      21)
    
      22sha256sums=('4a4cf21cafaf68498c76b0b38aede96b0ddb93cdd387e7f6ef15d194782a53fa'
    
      23            '82b530250cbae59b5b835528bc3555561c546c2b8c2729772b9a5a4736d4b8d0')
    
      24prepare() {
    
      25    bsdtar -xf "${srcdir}/data."*
    
      26    sed -i "5i\Name[zh_CN]=${_zhsname}" "${srcdir}/usr/share/applications/${_pkgname}.desktop"
    
      27    mv "${srcdir}/usr/share/icons/hicolor/256x256@2" "${srcdir}/usr/share/icons/hicolor/512x512"
    
      28}
    
      29package() {
    
      30    install -Dm755 "${srcdir}/usr/bin/${pkgname%-bin}" -t "${pkgdir}/usr/bin"
    
      31    cp -a "${srcdir}/usr/lib" "${pkgdir}/usr"
    
      32    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      33		_extension="${_i##*.}"
    
      34		_icon_path="${_i#*share/icons/}"
    
      35		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      36		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      37	done
    
      38    install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      39    install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      40}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-08 07:16:32	Medium	2