ikuuu-vpn
MEDIUM
maintainer yuhldr
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (client.files-2.eakpfo.cn) which is not the project's official domain, posing a supply-chain risk if the host is compromised or malicious.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source=("${_deb_file}::https://client.files-2.eakpfo.cn/file/ikuuu-client-release/client/${_deb_pkg}/${_deb_file}")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (client.files-2.eakpfo.cn) which is not the project's official domain, posing a supply-chain risk if the host is compromised or malicious.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: yuhldr yuhldr@qq.com
2
3
_pkgname="ikuuu_vpn"
4
_binname="ikuuu-vpn"
5
pkgname="${_binname}"
6
pkgver="0.17.5"
7
_buildid="22a756ce"
8
pkgrel=1
9
pkgdesc="iKuuuVPN (repacked from .deb)"
10
arch=('x86_64')
11
url="https://ikuuu.dev/"
12
license=('custom')
13
options=(!strip !debug)
14
depends=('gtk3' 'libsecret' 'libayatana-appindicator')
15
optdepends=('libkeybinder3: for global hotkeys')
16
# no provides/conflicts: keep only the canonical Arch package name
17
18
_deb_pkg="${_pkgname}-${pkgver}-${_buildid}"
19
_deb_file="${_deb_pkg}-linux-amd64.deb"
20
21
source=("${_deb_file}::https://client.files-2.eakpfo.cn/file/ikuuu-client-release/client/${_deb_pkg}/${_deb_file}")
22
23
sha256sums=('63fa28b2fe68f30142034e7943fefc04c5764744546045df4dc486d3559c9693')
24
25
prepare() {
26
bsdtar -xf "${_deb_file}"
27
}
28
29
build() {
30
:
31
}
32
33
package() {
34
bsdtar --no-same-owner --no-same-permissions -xf data.tar.xz -C "${pkgdir}"
35
36
# Desktop file: use a stable command name
37
sed -i \
38
-e "s|^Exec=.*|Exec=${_binname} %U|" \
39
"${pkgdir}/usr/share/applications/ikuuuvpn.desktop"
40
41
# License / notices
42
install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
43
install -m644 \
44
"${pkgdir}/usr/share/iKuuuVPN/data/flutter_assets/NOTICES.Z" \
45
"${pkgdir}/usr/share/licenses/${pkgname}/NOTICES.Z"
46
47
# Binary (canonical command name)
48
install -dm755 "${pkgdir}/usr/bin"
49
ln -s "../share/iKuuuVPN/iKuuuVPN" "${pkgdir}/usr/bin/${_binname}"
50
}
51
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |