js-design

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::https://img.js.design/assets/download/%E7%BB%9F%E4%BF%A1UOS/%E5%8D%B3%E6%97%B6%E8%AE%BE%E8%AE%A1_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt proprietary Electron/Chromium-based binary application downloaded from img.js.design, which is the CDN/asset host for the js.design (即时设计) commercial design tool. The host is not a standard Linux distribution mirror or well-known package registry, but it does appear to be the official vendor's own CDN (img.js.design is a subdomain of js.design, the product's own domain). The binary is a full Electron app that will execute on the user's system. The sha512 checksums are present, which mitigates tampering risk somewhat, but the checksums are only as trustworthy as the moment they were recorded — if the upstream URL serves a mutable/latest artifact (no version pinning in the URL path), the checksums could become stale or the file could be silently replaced. The URL does not contain the version string, meaning the same URL could serve different content over time, making reproducibility and integrity verification weaker. This is a real medium-severity supply-chain concern: an executed proprietary binary from a vendor CDN with mutable URLs, not a false positive, but also not clearly malicious.