irreader
maintainer AsukaMinato
· 0 votes
· scanned 2026-08-03 00:08:14.047287
Why flagged
This PKGBUILD explicitly patches the application's JavaScript code to bypass VIP/subscription licensing checks: it sets is_vip() to always return true, left_vip_days() to 999, and vip_source_limit to Infinity. This is software license circumvention (cracking), which constitutes piracy regardless of any other security concerns. The piracy flag alone mandates a 'high' severity per the rating rules. Additionally, the primary application archive is downloaded from download.fatecore.com (the vendor's own download host, not a GitHub release), which is a non-standard distribution channel, but the sha256 checksum is present. The main concern here is the deliberate license bypass, not the download host.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
source=("http://download.fatecore.com/irreader/irreader-$pkgver.zip"
HIGH
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 95%): This PKGBUILD explicitly patches the application's JavaScript code to bypass VIP/subscription licensing checks: it sets is_vip() to always return true, left_vip_days() to 999, and vip_source_limit to Infinity. This is software license circumvention (cracking), which constitutes piracy regardless of any other security concerns. The piracy flag alone mandates a 'high' severity per the rating rules. Additionally, the primary application archive is downloaded from download.fatecore.com (the vendor's own download host, not a GitHub release), which is a non-standard distribution channel, but the sha256 checksum is present. The main concern here is the deliberate license bypass, not the download host.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Asuka Minato <i at asukaminato dot eu dot org>
2
pkgname=irreader
3
pkgver=1.8.0
4
pkgrel=1
5
_sqlite3=5.1.7
6
pkgdesc="订阅网页、RSS和Podcast，具备急速的阅读体验，"
7
arch=(x86_64 aarch64)
8
url="http://irreader.fatecore.com/"
9
license=('PRIVATE')
10
depends=(electron39-bin bash gcc-libs glibc)
11
makedepends=(asar npm)
12
options=(!emptydirs)
13
source=("http://download.fatecore.com/irreader/irreader-$pkgver.zip"
14
$pkgname.desktop)
15
source_x86_64=("https://github.com/TryGhost/node-sqlite3/releases/download/v$_sqlite3/sqlite3-v$_sqlite3-napi-v6-linux-x64.tar.gz"
16
"https://github.com/TryGhost/node-sqlite3/releases/download/v$_sqlite3/sqlite3-v$_sqlite3-napi-v3-linux-x64.tar.gz")
17
source_aarch64=("https://github.com/TryGhost/node-sqlite3/releases/download/v$_sqlite3/sqlite3-v$_sqlite3-napi-v6-linux-arm64.tar.gz"
18
"https://github.com/TryGhost/node-sqlite3/releases/download/v$_sqlite3/sqlite3-v$_sqlite3-napi-v3-linux-arm64.tar.gz")
19
sha256sums=('62b0d92d66171cf7410147f7f34ef7a6519763c905bd1918be6cbaa6868a470f'
20
'65dfbe4147cc28945224bc554e2bdce2c98655d813a7ccb4fcc7de045c1053a9')
21
sha256sums_x86_64=('6d1f7a95e5aca90db1fd6a2839380a021d5ee23d46f2d7c520ded094da813fed'
22
'e1bc73859d215361ae18af3faf4c246a25b52aa782317c890dea2c0fda123437')
23
sha256sums_aarch64=('0f112c63a74bebdffce298792c264b3af4b85d7fe1975a4bca1227438f531dbb'
24
'61d1d092cb2fdad28eaf786ab950955cef5fe37a137f9cbd88c867ee56553b52')
25
26
prepare() {
27
rm *.gz
28
bsdtar -xvpf *.exe ./resources
29
asar e ./**/app.asar ./app
30
printf "
31
exports.is_vip = () => true;
32
exports.left_vip_days = () => 999;
33
exports.is_need_show_vip_renew = () => false;
34
" >>./app/libuser.js
35
printf "
36
exports.vip_source_limit = Infinity;
37
" >>./app/scs/scsdef.js
38
pushd app
39
rm -vrf ./node_modules/sqlite3/build/*
40
cp -av $srcdir/build ./node_modules/sqlite3/
41
rm -vrf ./node_modules/node-gyp/
42
rm -vrf ./node_modules/sqlite3/{build-tmp-napi-v6,deps}
43
find . \( -name "cli.js" -or -name "bin.js" \) -delete
44
find . -type f -path "*/node_modules/*" -and -path "*/bin/*" -printf "removed %p\n" -delete
45
find . -type f -path "*man/man*" -printf "removed %p\n" -delete
46
# rm -vr ./node_modules/sqlite3/node_modules/node-addon-api/tools/
47
# rm -v ./node_modules/duplexer2/example.js ./node_modules/ajv/scripts/info
48
}
49
50
package() {
51
install -d $pkgdir/opt/$pkgname/
52
cp -a app $pkgdir/opt/$pkgname/
53
printf "#!/bin/bash
54
set -eux -o pipefail
55
ELECTRON_ENABLE_LOGGING=1 exec electron39 /opt/$pkgname/app \"\$@\"
56
" | install -Dm755 /dev/stdin $pkgdir/usr/bin/$pkgname
57
install -Dm644 $pkgname.desktop -t "$pkgdir"/usr/share/applications/
58
find $pkgdir -type f -name "*.py" -printf "removed %p\n" -delete
59
find $pkgdir -type f -name "*.h" -printf "removed %p\n" -delete
60
find $pkgdir -type f -name "*.c" -printf "removed %p\n" -delete
61
find . -type f -name "icon_about_win.png" -exec install -Dm644 {} "$pkgdir"/usr/share/pixmaps/$pkgname.png \;
62
}
63
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | HIGH | 2 |
| 2026-08-02 00:16:08 | HIGH | 2 |
| 2026-08-01 00:11:18 | HIGH | 2 |
| 2026-07-31 00:14:10 | HIGH | 2 |
| 2026-07-30 00:17:23 | HIGH | 2 |
| 2026-07-29 00:25:53 | HIGH | 2 |
| 2026-07-28 00:07:28 | HIGH | 2 |
| 2026-07-27 00:24:32 | HIGH | 2 |
| 2026-07-26 00:07:32 | HIGH | 2 |
| 2026-07-25 00:13:44 | HIGH | 2 |
| 2026-07-24 00:02:28 | HIGH | 2 |
| 2026-07-23 00:14:47 | HIGH | 2 |
| 2026-07-22 00:29:32 | HIGH | 2 |
| 2026-07-21 00:24:15 | HIGH | 2 |
| 2026-07-20 00:19:49 | HIGH | 2 |
| 2026-07-19 00:17:08 | HIGH | 2 |
| 2026-07-18 00:14:48 | HIGH | 2 |
| 2026-07-17 00:06:16 | HIGH | 2 |
| 2026-07-16 00:05:41 | HIGH | 2 |
| 2026-07-15 00:09:25 | HIGH | 2 |