lunar-client-bin

MEDIUM
maintainer Felitendo 2 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package downloads a prebuilt AppImage from a non-whitelisted but project-owned domain (lunarclientprod.com), which is unverifiable and could be silently swapped; however, it is not obfuscated or piped to shell, and the domain is plausibly official.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:27 source=("${_pkgname}-${pkgver}.AppImage::https://launcher-releases.lunarclientprod.com/master/6e18b5a4f4ebbd4c7ecff572f1700cedce1f248bcb157adce5ec49be9e081a23/${_appimage}")
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt AppImage from a non-whitelisted but project-owned domain (lunarclientprod.com), which is unverifiable and could be silently swapped; however, it is not obfuscated or piped to shell, and the domain is plausibly official.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Felitendo
2# This PKGBUILD is updated automatically:
3# https://github.com/Felitendo/PKGBUILDS
4
5pkgname=lunar-client-bin
6_pkgname=lunarclient
7pkgver=3.7.28
8pkgrel=1
9pkgdesc="All-in-one modpack with mods, settings and cosmetics for all Minecraft versions (upstream AppImage)"
10arch=('x86_64')
11url="https://lunarclient.com"
12license=('LicenseRef-proprietary')
13# The AppImage runs as it is: its runtime loads fuse2 and zlib. The rest is
14# what the Electron app inside links (readelf -d), plus what Minecraft loads.
15depends=('fuse2' 'zlib'
16 'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'glibc' 'gtk3'
17 'libcups' 'libgcc' 'libstdc++' 'libx11' 'libxcb' 'libxcomposite'
18 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'mesa'
19 'nspr' 'nss' 'pango' 'systemd-libs'
20 # loaded by Minecraft, not by the launcher
21 'libgl' 'libpulse' 'libxcursor' 'libxxf86vm' 'xorg-xrandr')
22provides=('lunar-client' 'lunarclient')
23conflicts=('lunar-client' 'lunarclient')
24options=('!strip' '!debug')
25# maintained by CI together with pkgver (upstream varies the filename suffix)
26_appimage="Lunar%20Client-3.7.28-ow.AppImage"
27source=("${_pkgname}-${pkgver}.AppImage::https://launcher-releases.lunarclientprod.com/master/6e18b5a4f4ebbd4c7ecff572f1700cedce1f248bcb157adce5ec49be9e081a23/${_appimage}")
28sha256sums=('f79e41dc877fc3865463e3c5d507aab4ee2f572649ec28380cf02a657c53f968')
29
30prepare() {
31 chmod +x "${_pkgname}-${pkgver}.AppImage"
32 "./${_pkgname}-${pkgver}.AppImage" --appimage-extract
33}
34
35build() {
36 # make the .desktop file work outside of the AppImage container
37 sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_pkgname}|" \
38 "squashfs-root/${_pkgname}.desktop"
39 # AppImage directory permissions are 700
40 chmod -R a-x+rX squashfs-root/usr
41}
42
43package() {
44 install -Dm755 "${srcdir}/${_pkgname}-${pkgver}.AppImage" \
45 "${pkgdir}/opt/${_pkgname}/${_pkgname}.AppImage"
46
47 install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop" \
48 "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
49
50 install -Dm644 \
51 "${srcdir}/squashfs-root/usr/share/icons/hicolor/1024x1024/apps/${_pkgname}.png" \
52 "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${_pkgname}.png"
53
54 install -dm755 "${pkgdir}/usr/bin"
55 ln -s "/opt/${_pkgname}/${_pkgname}.AppImage" "${pkgdir}/usr/bin/${_pkgname}"
56
57 # A custom licence has to ship its terms. Lunar Client publishes none in the
58 # AppImage, so what goes in is the reference to the terms it is used under.
59 install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<'EOF'
60Lunar Client is proprietary software, distributed by Moonsworth, LLC.
61
62It is not covered by a free-software licence: use is governed by the terms
63of service the vendor publishes, and redistribution of the AppImage this
64package installs is not granted by them.
65
66Terms of service: https://www.lunarclient.com/terms
67EOF
68}
69

Changes since previous scan

--- PKGBUILD @ 2026-10-31 13:58
+++ PKGBUILD @ 2026-11-01 00:21
@@ -4,9 +4,9 @@
pkgname=lunar-client-bin
_pkgname=lunarclient
-pkgver=3.7.17
-pkgrel=3
-pkgdesc="PvP modpack for all modern versions of Minecraft (upstream AppImage)"
+pkgver=3.7.28
+pkgrel=1
+pkgdesc="All-in-one modpack with mods, settings and cosmetics for all Minecraft versions (upstream AppImage)"
arch=('x86_64')
url="https://lunarclient.com"
license=('LicenseRef-proprietary')
@@ -23,9 +23,9 @@
conflicts=('lunar-client' 'lunarclient')
options=('!strip' '!debug')
# maintained by CI together with pkgver (upstream varies the filename suffix)
-_appimage="Lunar%20Client-3.7.17-ow.AppImage"
-source=("${_pkgname}-${pkgver}.AppImage::https://launcherupdates.lunarclientcdn.com/${_appimage}")
-sha256sums=('4d298f99de13941c37f044623c02687d59ad52cbcedb7eab5d5b297db1937470')
+_appimage="Lunar%20Client-3.7.28-ow.AppImage"
+source=("${_pkgname}-${pkgver}.AppImage::https://launcher-releases.lunarclientprod.com/master/6e18b5a4f4ebbd4c7ecff572f1700cedce1f248bcb157adce5ec49be9e081a23/${_appimage}")
+sha256sums=('f79e41dc877fc3865463e3c5d507aab4ee2f572649ec28380cf02a657c53f968')
prepare() {
chmod +x "${_pkgname}-${pkgver}.AppImage"

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Medium 2
2026-10-31 19:58:49 Medium 2
2026-10-31 13:58:24 Medium 1
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 11:50:06 Medium 1
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion