linked-helper

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt binary .deb is downloaded from a CloudFront CDN URL (do0ca1hx6twig.cloudfront.net) that is not the official vendor domain (linkedhelper.com). The URL contains what looks like a hash path component, but sha512sums is set to SKIP, meaning no integrity verification is performed at build time. The .deb is then extracted and its contents installed directly into pkgdir, including whatever executables/libraries it contains. This is a classic supply-chain risk: if the CloudFront distribution is compromised, misconfigured, or the URL is hijacked, arbitrary code would be installed and executed on the user's system. The CloudFront URL may be the vendor's own CDN (many vendors use CloudFront for distribution), but it cannot be verified as official from the PKGBUILD alone, and the absence of any checksum makes it impossible to detect substitution. This matches the definition of medium: an executed binary from a host that cannot be confirmed as the official upstream source, with no integrity check.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://do0ca1hx6twig.cloudfront.net/linked-helper/444657160c922f6b8048468fef840020/latest/linux/x64/linked-helper.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): A prebuilt binary .deb is downloaded from a CloudFront CDN URL (do0ca1hx6twig.cloudfront.net) that is not the official vendor domain (linkedhelper.com). The URL contains what looks like a hash path component, but sha512sums is set to SKIP, meaning no integrity verification is performed at build time. The .deb is then extracted and its contents installed directly into pkgdir, including whatever executables/libraries it contains. This is a classic supply-chain risk: if the CloudFront distribution is compromised, misconfigured, or the URL is hijacked, arbitrary code would be installed and executed on the user's system. The CloudFront URL may be the vendor's own CDN (many vendors use CloudFront for distribution), but it cannot be verified as official from the PKGBUILD alone, and the absence of any checksum makes it impossible to detect substitution. This matches the definition of medium: an executed binary from a host that cannot be confirmed as the official upstream source, with no integrity check.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Eugene Lopatkin <eugenelopatkin@gmail.com>
    
      2pkgname="linked-helper"
    
      3pkgver="2.14.60"
    
      4pkgrel=1
    
      5pkgdesc="LinkedIn lead generation tool businesses use to find clients"
    
      6arch=("any")
    
      7url="https://www.linkedhelper.com/"
    
      8license=("unknown")
    
      9depends=("gtk3" "libnotify" "nss" "libxtst" "xdg-utils" "at-spi2-core" "libdrm" "mesa" "libxcb")
    
      10optdepends=("kde-cli-tools" "kdepim-runtime" "trash-cli" "glib2" "gvfs" "pulseaudio" "alsa-lib" "gnome-keyring" "lsb-release")
    
      11source=("https://do0ca1hx6twig.cloudfront.net/linked-helper/444657160c922f6b8048468fef840020/latest/linux/x64/linked-helper.deb")
    
      12noextract=("linked-helper.deb")
    
      13sha512sums=('SKIP')
    
      14
    
      15pkgver() {
    
      16	bsdtar -O -xf linked-helper.deb control.tar.xz | bsdtar -xJf -
    
      17	version=$(grep -Po '^Version: \K.*' control)
    
      18	rm control
    
      19	echo $version
    
      20}
    
      21
    
      22package() {
    
      23    bsdtar -O -xf linked-helper.deb data.tar.xz | bsdtar -C "$pkgdir" -xJf -
    
      24    find "${pkgdir}" -type d -exec chmod 755 {} +
    
      25
    
      26    rm -rf "${pkgdir}/usr/share/lintian"
    
      27    rm -rf "${pkgdir}/usr/share/doc"
    
      28    rm "${startdir}/linked-helper.deb"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2