js-design-electron-bin
MEDIUM
maintainer zxp19821005
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt AppImage from a non-standard host (download.js.design), which is not on common trust whitelists and could allow supply-chain tampering of an executable with a skipped checksum; however, it is plausibly the official project's own distribution domain.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
"${pkgname%-bin}-${pkgver}-x86_64.AppImage::https://download.js.design/assets/download/%E5%8D%B3%E6%97%B6%E8%AE%BE%E8%AE%A1%20Linux%E7%89%88.AppImage"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt AppImage from a non-standard host (download.js.design), which is not on common trust whitelists and could allow supply-chain tampering of an executable with a skipped checksum; however, it is plausibly the official project's own distribution domain.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
_pkgname=js.design
3
pkgname="${_pkgname//./-}-electron-bin"
4
pkgver=1.0.7
5
_electronversion=15
6
pkgrel=5
7
pkgdesc="A professional UI design software tailored for Chinese designers.(Prebuilt version.Use system-wide electron)即时设计"
8
arch=('x86_64')
9
url="https://js.design"
10
license=("LicenseRef-custom")
11
conflicts=("${_pkgname//./-}")
12
depends=(
13
"electron${_electronversion}"
14
)
15
source=(
16
"${pkgname%-bin}-${pkgver}-x86_64.AppImage::https://download.js.design/assets/download/%E5%8D%B3%E6%97%B6%E8%AE%BE%E8%AE%A1%20Linux%E7%89%88.AppImage"
17
"LICENSE.txt"
18
"${pkgname%-bin}.sh"
19
)
20
sha256sums=('3697482be454c0191810f39b0b93eb3c28eb5e9c77c6c3ad0634269f8e1a2bd5'
21
'f1c8afcb7fbd3ad91d1f8b4bea8d66a21f9cb85be22b16ce652b66ca9473c616'
22
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
23
pkgver() {
24
cd "${srcdir}/squashfs-root"
25
grep "X-AppImage-Version" "${_pkgname}.desktop" | sed "s/X-AppImage-Version=//g"
26
}
27
_get_app_dir() {
28
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
29
}
30
_check_electron_version() {
31
echo "Verifying Electron version..."
32
local _app_dir=$(_get_app_dir)
33
local _main_exe=""
34
if [[ -n "${_app_dir}" ]]; then
35
_main_exe=$(find "${_app_dir}" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -n 1 | cut -d' ' -f2-)
36
fi
37
if [[ -n "${_main_exe}" ]]; then
38
local _elec_ver=$(strings "${_main_exe}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1 | head -n 1)
39
if [[ -n "${_elec_ver}" ]]; then
40
if [[ "${_elec_ver}" != "${_electronversion}" ]]; then
41
echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m"
42
else
43
echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
44
fi
45
fi
46
else
47
echo -e "\033[1;33mNote: Could not find Electron binary for version verification.\033[0m"
48
fi
49
}
50
prepare() {
51
sed -i -e "
52
s/@electronversion@/${_electronversion}/g
53
s/@appname@/${pkgname%-bin}/g
54
s/@runname@/app.asar/g
55
s/@cfgdirname@/${_pkgname}/g
56
" "${srcdir}/${pkgname%-bin}.sh"
57
if [ ! -x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" ];then
58
chmod +x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage"
59
fi
60
if [ -d "${srcdir}/squashfs-root" ];then
61
rm -rf "${srcdir}/squashfs-root"
62
fi
63
"${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" --appimage-extract > /dev/null
64
_check_electron_version
65
local _app_dir=$(_get_app_dir)
66
sed -i -e "
67
s/AppRun --no-sandbox/${pkgname%-bin}/g
68
s/Icon=${_pkgname}/Icon=${pkgname%-bin}/g
69
" "${_app_dir}/${_pkgname}.desktop"
70
}
71
package() {
72
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
73
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
74
local _app_dir=$(_get_app_dir)
75
cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-bin}/"
76
install -Dm644 "${_app_dir}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
77
find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
78
_extension="${_i##*.}"
79
_icon_path="${_i#*share/icons/}"
80
_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
81
install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
82
done
83
install -Dm644 "${srcdir}/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
84
}
85
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |