ikuuu-vpn
MEDIUM
maintainer yuhldr
2 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (client.files-2.eakpfo.cn) which is not the project's official domain, posing a supply-chain risk if the host is compromised or malicious.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source=("${_deb_file}::https://client.files-2.eakpfo.cn/file/ikuuu-client-release/client/${_deb_pkg}/${_deb_file}")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (client.files-2.eakpfo.cn) which is not the project's official domain, posing a supply-chain risk if the host is compromised or malicious.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: yuhldr yuhldr@qq.com
2
3
_pkgname="ikuuu_vpn"
4
_binname="ikuuu-vpn"
5
pkgname="${_binname}"
6
pkgver="0.17.5"
7
_buildid="22a756ce"
8
pkgrel=1
9
pkgdesc="iKuuuVPN (repacked from .deb)"
10
arch=('x86_64')
11
url="https://ikuuu.dev/"
12
license=('custom')
13
options=(!strip !debug)
14
depends=('gtk3' 'libsecret' 'libayatana-appindicator')
15
optdepends=('libkeybinder3: for global hotkeys')
16
# no provides/conflicts: keep only the canonical Arch package name
17
18
_deb_pkg="${_pkgname}-${pkgver}-${_buildid}"
19
_deb_file="${_deb_pkg}-linux-amd64.deb"
20
21
source=("${_deb_file}::https://client.files-2.eakpfo.cn/file/ikuuu-client-release/client/${_deb_pkg}/${_deb_file}")
22
23
sha256sums=('63fa28b2fe68f30142034e7943fefc04c5764744546045df4dc486d3559c9693')
24
25
prepare() {
26
bsdtar -xf "${_deb_file}"
27
}
28
29
build() {
30
:
31
}
32
33
package() {
34
bsdtar --no-same-owner --no-same-permissions -xf data.tar.xz -C "${pkgdir}"
35
36
# Desktop file: use a stable command name
37
sed -i \
38
-e "s|^Exec=.*|Exec=${_binname} %U|" \
39
"${pkgdir}/usr/share/applications/ikuuuvpn.desktop"
40
41
# License / notices
42
install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
43
install -m644 \
44
"${pkgdir}/usr/share/iKuuuVPN/data/flutter_assets/NOTICES.Z" \
45
"${pkgdir}/usr/share/licenses/${pkgname}/NOTICES.Z"
46
47
# Binary (canonical command name)
48
install -dm755 "${pkgdir}/usr/bin"
49
ln -s "../share/iKuuuVPN/iKuuuVPN" "${pkgdir}/usr/bin/${_binname}"
50
}
51
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |