iqoption-bin

maintainer mracos · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from updates.iqoption.com (the official IQ Option update server) and installs it directly. While the host appears to be the vendor's own update infrastructure, there are two genuine concerns: (1) sha256sums=('SKIP') means no integrity verification is performed, so a MITM or server-side substitution would go undetected; (2) the package extracts and installs a prebuilt binary blob directly into the system without any checksum validation. The URL pattern (/api/v1/build/current/pkg/LinuxGL) always fetches the 'current' build, making this a rolling binary with no pinning. The pkgver() function reads the version from the extracted control file after the fact, which is unusual but not malicious. The host itself appears to be the legitimate vendor update endpoint, so this is not clearly malicious, but the combination of an executed binary from a remote host with SKIP'd checksums constitutes a real supply-chain risk (no reproducibility, no integrity guarantee). This is a textbook medium-severity concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("iqoption.deb::https://updates.iqoption.com/api/v1/build/current/pkg/LinuxGL")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads a prebuilt binary .deb from updates.iqoption.com (the official IQ Option update server) and installs it directly. While the host appears to be the vendor's own update infrastructure, there are two genuine concerns: (1) sha256sums=('SKIP') means no integrity verification is performed, so a MITM or server-side substitution would go undetected; (2) the package extracts and installs a prebuilt binary blob directly into the system without any checksum validation. The URL pattern (/api/v1/build/current/pkg/LinuxGL) always fetches the 'current' build, making this a rolling binary with no pinning. The pkgver() function reads the version from the extracted control file after the fact, which is unusual but not malicious. The host itself appears to be the legitimate vendor update endpoint, so this is not clearly malicious, but the combination of an executed binary from a remote host with SKIP'd checksums constitutes a real supply-chain risk (no reproducibility, no integrity guarantee). This is a textbook medium-severity concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Marcos Ferreira <merkkp at gmail dot com>
    
      2
    
      3pkgname="iqoption-bin"
    
      4pkgver=1247.3.5090
    
      5pkgrel=1
    
      6pkgdesc="Ultimate trading experience"
    
      7arch=("x86_64")
    
      8url="https://iqoption.com"
    
      9license=("custom:iqoption")
    
      10depends=("sdl2" "sdl2_image" "sdl2_mixer" "mesa" "libnotify")
    
      11makedepends=("binutils" "tar" "sed")
    
      12source=("iqoption.deb::https://updates.iqoption.com/api/v1/build/current/pkg/LinuxGL")
    
      13sha256sums=("SKIP")
    
      14
    
      15prepare() {
    
      16  tar xf control.tar.gz
    
      17}
    
      18
    
      19pkgver() {
    
      20  cat control | head -n 2 | tail -n 1 | cut -d' ' -f 2
    
      21}
    
      22
    
      23package() {
    
      24  tar xf data.tar.xz -C "${pkgdir}/"
    
      25  _desktop_file=${pkgdir}/usr/share/applications/iqoption.desktop
    
      26  sed -i 's/Exec\S*/Exec=sh -c "SDL_VIDEO_MINIMIZE_ON_FOCUS_LOSS=0 IQOption"/' $_desktop_file
    
      27}
    
      28
    
      29# vim:set ts=2 sw=2 et:
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2