koishipro-bin

maintainer taotieren · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs a prebuilt binary tarball (containing executables: 'bot' and 'ygopro') from cdn02.moecube.com:444, which is a CDN operated by Moecube (a Chinese gaming community), not the official upstream project host (koishi.pro). The tarball is extracted directly into /opt and wrapper scripts are created to execute the binaries. A sha256 checksum is present, which mitigates substitution attacks somewhat, but the source is a mutable URL (no version pinning beyond 'master') pointing to a non-official CDN. The pkgver is 'Desire' (a codename) and the source URL contains 'master', meaning the tarball content could change while the checksum remains stale if the maintainer doesn't update it. The core concern is that prebuilt binaries from a third-party CDN (not the project's own release infrastructure) are being installed and executed — this is a genuine supply-chain risk pattern. However, there is no evidence of active malice, obfuscation, or exfiltration; it appears to be a legitimate but non-ideal packaging of a YGOPro derivative game.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://cdn02.moecube.com:444/koishipro/archive/KoishiPro-master-linux-zh-CN.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs a prebuilt binary tarball (containing executables: 'bot' and 'ygopro') from cdn02.moecube.com:444, which is a CDN operated by Moecube (a Chinese gaming community), not the official upstream project host (koishi.pro). The tarball is extracted directly into /opt and wrapper scripts are created to execute the binaries. A sha256 checksum is present, which mitigates substitution attacks somewhat, but the source is a mutable URL (no version pinning beyond 'master') pointing to a non-official CDN. The pkgver is 'Desire' (a codename) and the source URL contains 'master', meaning the tarball content could change while the checksum remains stale if the maintainer doesn't update it. The core concern is that prebuilt binaries from a third-party CDN (not the project's own release infrastructure) are being installed and executed — this is a genuine supply-chain risk pattern. However, there is no evidence of active malice, obfuscation, or exfiltration; it appears to be a legitimate but non-ideal packaging of a YGOPro derivative game.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2
    
      3pkgname=koishipro-bin
    
      4pkgver=Desire
    
      5pkgrel=1
    
      6pkgdesc="KoishiPro 是一个 YGOPro 的衍生项目。KoishiPro 比 YGOPro 具有更多的扩展功能和游戏体验。"
    
      7arch=('any')
    
      8url="https://koishi.pro/"
    
      9license=('GPL2')
    
      10provides=(${pkgname})
    
      11conflicts=(${pkgname} ${pkgname%-bin} ${pkgname}-git ygopro ygopro-bin)
    
      12#replaces=(${pkgname})
    
      13depends=('mono')
    
      14makedepends=('libarchive')
    
      15backup=(opt/${pkgname%-bin}/system.conf)
    
      16options=('!strip')
    
      17#install=${pkgname}.install
    
      18source=("https://cdn02.moecube.com:444/koishipro/archive/KoishiPro-master-linux-zh-CN.tar.gz")
    
      19sha256sums=('3334bf21d0a981ee4eceb94c8cf9a8385db09ac649ca2a06cf9c62cedd482976')
    
      20noextract=(KoishiPro-master-linux-zh-CN.tar.gz)
    
      21
    
      22package() {
    
      23    install -dm0755 "${pkgdir}/opt/${pkgname%-bin}" \
    
      24                    "${pkgdir}/usr/share/pixmaps/" \
    
      25                    "${pkgdir}/usr/share/applications/" \
    
      26                    "${pkgdir}/usr/share/licenses/${pkgname%-bin}/"
    
      27
    
      28    _pkg=ygopro
    
      29
    
      30    bsdtar xf "${srcdir}/KoishiPro-master-linux-zh-CN.tar.gz" -C  "${pkgdir}/opt/${pkgname%-bin}"
    
      31
    
      32    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/${pkgname%-bin}" << EOF
    
      33#!/bin/sh
    
      34/opt/${pkgname%-bin}/bot "\$@"
    
      35EOF
    
      36
    
      37    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/${_pkg}" << EOF
    
      38#!/bin/sh
    
      39/opt/${pkgname%-bin}/${_pkg} "\$@"
    
      40EOF
    
      41
    
      42    install -Dm0644 /dev/stdin "${pkgdir}/opt/${pkgname%-bin}/${pkgname%-bin}.desktop" << EOF
    
      43[Desktop Entry]
    
      44Name=KoishiPro
    
      45Name[en_US]=KoishiPro
    
      46Categories=Game
    
      47Exec=${pkgname%-bin} %U
    
      48Terminal=false
    
      49Type=Application
    
      50Icon=${pkgname%-bin}.png
    
      51Encoding=UTF-8
    
      52Hidden=false
    
      53StartupNotify=false
    
      54Comment=KoishiPro
    
      55Comment[zh_CN]=KoishiPro
    
      56
    
      57EOF
    
      58
    
      59    install -Dm0644 /dev/stdin "${pkgdir}/opt/${pkgname%-bin}/${_pkg}.desktop" << EOF
    
      60[Desktop Entry]
    
      61Name=YGOPro
    
      62Name[en_US]=YGOPro
    
      63Categories=Game
    
      64Exec=${_pkg} %U
    
      65Terminal=false
    
      66Type=Application
    
      67Icon=${_pkg}.png
    
      68Encoding=UTF-8
    
      69Hidden=false
    
      70StartupNotify=false
    
      71Comment=YGOPro
    
      72Comment[zh_CN]=YGOPro
    
      73EOF
    
      74
    
      75    ln -sf "/opt/${pkgname%-bin}/${pkgname%-bin}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      76    ln -sf "/opt/${pkgname%-bin}/${_pkg}.desktop" "${pkgdir}/usr/share/applications/${_pkg}.desktop"
    
      77    ln -sf "/opt/${pkgname%-bin}/${pkgname%-bin}.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-bin}.png"
    
      78    ln -sf "/opt/${pkgname%-bin}/${_pkg}.png" "${pkgdir}/usr/share/pixmaps/${_pkg}.png"
    
      79    ln -sf "/opt/${pkgname%-bin}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname%-bin}/LICENSE"
    
      80}
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2