js-design-appimage

maintainer charlottedurand · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage from img.js.design (the CDN/asset host for the js.design commercial design tool), extracts it, and installs the app.asar and native libraries. The host img.js.design is the official asset delivery domain for js.design (即时设计), a legitimate Chinese SaaS design product, so this is not a random personal host. However, the AppImage is a prebuilt binary blob from a commercial vendor's CDN rather than a reproducible build from source, and the sha256sum pins the specific file, which mitigates substitution risk. The pattern is standard for AUR AppImage wrappers of proprietary software. The medium rating is marginally justified because it is still an executed prebuilt binary from a vendor CDN (not source-built), but there is no evidence of malice, obfuscation, or unofficial hosting — this is the vendor's own distribution channel. The risk is the inherent supply-chain trust placed in the vendor's CDN, which is the same risk as any proprietary binary package. This is a common and accepted AUR pattern for proprietary software distributed as AppImages.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "${pkgname%-appimage}-${pkgver}.AppImage::https://img.js.design/assets/download/%E5%8D%B3%E6%97%B6%E8%AE%BE%E8%AE%A1%20Linux%E7%89%88.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage from img.js.design (the CDN/asset host for the js.design commercial design tool), extracts it, and installs the app.asar and native libraries. The host img.js.design is the official asset delivery domain for js.design (即时设计), a legitimate Chinese SaaS design product, so this is not a random personal host. However, the AppImage is a prebuilt binary blob from a commercial vendor's CDN rather than a reproducible build from source, and the sha256sum pins the specific file, which mitigates substitution risk. The pattern is standard for AUR AppImage wrappers of proprietary software. The medium rating is marginally justified because it is still an executed prebuilt binary from a vendor CDN (not source-built), but there is no evidence of malice, obfuscation, or unofficial hosting — this is the vendor's own distribution channel. The risk is the inherent supply-chain trust placed in the vendor's CDN, which is the same risk as any proprietary binary package. This is a common and accepted AUR pattern for proprietary software distributed as AppImages.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2_pkgname=js.design
    
      3pkgname="${_pkgname//./-}-appimage"
    
      4pkgver=1.0.6
    
      5_electronversion=25
    
      6pkgrel=6
    
      7pkgdesc="即时设计 A professional UI design software tailored for Chinese designers."
    
      8arch=("x86_64")
    
      9url="https://js.design"
    
      10license=("LicenseRef-custom")
    
      11conflicts=("${pkgname%-appimage}")
    
      12depends=(
    
      13    "electron${_electronversion}"
    
      14    'dbus-glib'
    
      15    'libdbusmenu-glib'
    
      16    'gtk2'
    
      17)
    
      18makedepends=(
    
      19    'squashfuse'
    
      20)
    
      21source=(
    
      22    "${pkgname%-appimage}-${pkgver}.AppImage::https://img.js.design/assets/download/%E5%8D%B3%E6%97%B6%E8%AE%BE%E8%AE%A1%20Linux%E7%89%88.AppImage"
    
      23    "LICENSE.html"
    
      24    "${pkgname%-appimage}.sh"
    
      25)
    
      26sha256sums=('3697482be454c0191810f39b0b93eb3c28eb5e9c77c6c3ad0634269f8e1a2bd5'
    
      27            'f1c8afcb7fbd3ad91d1f8b4bea8d66a21f9cb85be22b16ce652b66ca9473c616'
    
      28            '0fb7b939a071f4a08476bdd5aa143d2aa8cd335c83309f9919be16cd5c3e2014')
    
      29build() {
    
      30    sed -e "s|@electronversion@|${_electronversion}|g" \
    
      31        -e "s|@appname@|${pkgname%-bin}|g" \
    
      32        -e "s|@runname@|app.asar|g" \
    
      33        -i "${srcdir}/${pkgname%-appimage}.sh"
    
      34    chmod a+x "${srcdir}/${pkgname%-appimage}-${pkgver}.AppImage"
    
      35    "${srcdir}/${pkgname%-appimage}-${pkgver}.AppImage" --appimage-extract > /dev/null
    
      36    sed "s|AppRun --no-sandbox|${pkgname%-appimage}|g;s|Icon=${_pkgname}|Icon=${pkgname%-appimage}|g" -i "${srcdir}/squashfs-root/${_pkgname}.desktop"
    
      37}    
    
      38package() {
    
      39    install -Dm755 "${srcdir}/${pkgname%-appimage}.sh" "${pkgdir}/usr/bin/${pkgname%-appimage}"
    
      40    install -Dm644 "${srcdir}/squashfs-root/resources/app.asar" "${pkgdir}/usr/lib/${pkgname%-appimage}"
    
      41    install -Dm644 "${srcdir}/squashfs-root/swiftshader/"* -t "${pkgdir}/usr/lib/${pkgname%-bin}/swiftshader"
    
      42    install -Dm644 "${srcdir}/squashfs-root/usr/lib/"* -t "${pkgdir}/usr/lib/${pkgname%-bin}/lib"
    
      43    install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-appimage}.desktop"
    
      44    install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/0x0/apps/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-appimage}.png"
    
      45    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      46}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2