krunker

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from client2.krunker.io (the official Krunker game client CDN, not a personal/unofficial host) with SKIP'd checksum. The host appears to be the official distribution endpoint for the Krunker desktop client, which explains the SKIP — the URL serves a rolling/latest release without a versioned filename, so a pinned hash would break on updates. However, SKIP on an executed binary is a genuine supply-chain concern: there is no integrity verification, meaning a compromised CDN or MITM could substitute arbitrary code that gets installed and executed. The AppImage is also extracted and run during the package() phase (./$_filename --appimage-extract ...) which executes the downloaded binary at build time. This is a real medium-severity concern: an unofficial-ish CDN subdomain serving an unversioned, unchecksum'd executable that is both run at build time and installed for user execution. Not clearly malicious, but the lack of any integrity check on an executed binary warrants medium.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 'https://client2.krunker.io/setup.AppImage'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from client2.krunker.io (the official Krunker game client CDN, not a personal/unofficial host) with SKIP'd checksum. The host appears to be the official distribution endpoint for the Krunker desktop client, which explains the SKIP — the URL serves a rolling/latest release without a versioned filename, so a pinned hash would break on updates. However, SKIP on an executed binary is a genuine supply-chain concern: there is no integrity verification, meaning a compromised CDN or MITM could substitute arbitrary code that gets installed and executed. The AppImage is also extracted and run during the package() phase (./$_filename --appimage-extract ...) which executes the downloaded binary at build time. This is a real medium-severity concern: an unofficial-ish CDN subdomain serving an unversioned, unchecksum'd executable that is both run at build time and installed for user execution. Not clearly malicious, but the lack of any integrity check on an executed binary warrants medium.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jimin Kim <developomp@gmail.com>
    
      2
    
      3pkgname='krunker'
    
      4pkgver='2.1.3'
    
      5pkgrel=1
    
      6
    
      7pkgdesc="A free Multiplayer Online Game. No Download needed."
    
      8arch=('x86_64')
    
      9license=('custom') # https://krunker.io/docs/terms.txt
    
      10url='https://krunker.io'
    
      11options=(!strip) # necessary otherwise the AppImage file in the package is truncated
    
      12
    
      13depends=()
    
      14makedepends=()
    
      15
    
      16source=(
    
      17  'https://client2.krunker.io/setup.AppImage'
    
      18  'terms.txt'
    
      19  'krunker'
    
      20)
    
      21
    
      22sha256sums=(
    
      23  'SKIP'
    
      24  'f1181c174d40d8f38117dc86a498df1db45ccd52ee0d0c3028be7a8c8b5560cc'
    
      25  '3226cb60d743aab6f1704d08ee9e581c526a91c6b44cd0162324f6e4c1e2b7e5'
    
      26)
    
      27
    
      28_filename=krunker.AppImage
    
      29
    
      30package() {
    
      31  # Change filename from setup.AppImage to krunker.AppImage
    
      32  mv "setup.AppImage" $_filename
    
      33
    
      34  chmod +x $_filename
    
      35  mkdir -p squashfs-root/usr/share/icons/hicolor/{72x72,16x16}/apps
    
      36  ./$_filename --appimage-extract "usr/share/icons/hicolor/*/apps/io.krunker.desktop.png" > /dev/null 2>&1
    
      37  ./$_filename --appimage-extract io.krunker.desktop.desktop > /dev/null 2>&1
    
      38  INSTALL_PATH="/opt/appimages/$_filename"
    
      39  sed -i -E "s|Exec=AppRun|Exec=$INSTALL_PATH|" squashfs-root/io.krunker.desktop.desktop
    
      40  sed -i -E "s|Icon=io.krunker.desktop|Icon=/usr/share/icons/hicolor/0x0/apps/io.krunker.desktop.png|" squashfs-root/io.krunker.desktop.desktop
    
      41
    
      42  # install icons
    
      43  install -dm755 "$pkgdir/usr/share/icons"
    
      44  cp -dpr --no-preserve=ownership "squashfs-root/usr/share/icons" "$pkgdir/usr/share"
    
      45  chmod -R 755 "$pkgdir/usr/share/icons"
    
      46  find "$pkgdir/usr/share/icons" -type f -name "io.krunker.desktop.png" -exec chmod 644 {} \;
    
      47
    
      48  # install .desktop file and image file
    
      49  install -Dm644 "squashfs-root/io.krunker.desktop.desktop" "$pkgdir/usr/share/applications/krunker.desktop"
    
      50  install -Dm755 "$_filename" "$pkgdir$INSTALL_PATH"
    
      51
    
      52  # install license file
    
      53  install -Dm644 "terms.txt" "$pkgdir/usr/share/licenses/krunker/terms.txt"
    
      54
    
      55  # disable AppImage integration prompt
    
      56  # https://github.com/electron-userland/electron-builder/issues/1962
    
      57  install -dm755 "$pkgdir/usr/share/appimagekit"
    
      58  touch "$pkgdir/usr/share/appimagekit/no_desktopintegration"
    
      59  chmod 644 "$pkgdir/usr/share/appimagekit/no_desktopintegration"
    
      60
    
      61  # Launch script
    
      62  mkdir -p "$pkgdir/usr/bin/"
    
      63  install -Dm755 "$srcdir/krunker" "$pkgdir/usr/bin/krunker"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2