kontur-talk

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("https://st.ktalk.host/ktalk-app/linux/ktalk${pkgver}amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and installs a prebuilt proprietary binary .deb package from st.ktalk.host, which is a subdomain associated with Kontur Talk (ktalk), a Russian enterprise video conferencing product by SKB Kontur. The domain is plausibly the official distribution host for this software (ktalk = Kontur Talk, st = static/storage), and the URL pattern matches what one would expect from a vendor CDN. However, it is not a well-known public forge or package registry, there is no GPG signature verification, and the only integrity check is a single sha256sum. The binary is extracted and installed directly into the system (Electron-based app given the gtk3/nss/libxtst deps). This is a classic medium-risk pattern: a closed-source prebuilt binary from a vendor-controlled but unverifiable host, with no signature chain. If the host were compromised or the maintainer updates the hash to a malicious binary, arbitrary code execution would result. Not clearly malicious, but a genuine supply-chain concern warranting medium severity.