max-bin

MEDIUM

maintainer kuhtoxo 22 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt RPM from a non-whitelisted, project-owned host (download.max.ru), which is not a standard or widely trusted distribution domain; if compromised, an attacker could silently replace the binary payload, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 source_x86_64=("https://download.max.ru/linux/rpm/el/9/${arch}/${_filename}")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt RPM from a non-whitelisted, project-owned host (download.max.ru), which is not a standard or widely trusted distribution domain; if compromised, an attacker could silently replace the binary payload, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: KUHTOXO https://aur.archlinux.org/account/kuhtoxo
    
      2
    
      3pkgname=max-bin
    
      4pkgver=26.38.0.82021
    
      5pkgrel=1
    
      6
    
      7pkgdesc="MAX messenger."
    
      8arch=("x86_64")
    
      9url='https://max.ru'
    
      10license=("custom:max")
    
      11categories=("network")
    
      12
    
      13depends=(
    
      14         "ca-certificates"
    
      15         "glib2"
    
      16         "libxcb"
    
      17         "libxinerama"
    
      18         "libxcomposite"
    
      19         "libxss"
    
      20         "xcb-util-wm"
    
      21         "xcb-util-cursor"
    
      22         "xcb-util-keysyms"
    
      23         "libxkbcommon"
    
      24         "libva"
    
      25         "libxaw"
    
      26         "libvdpau"
    
      27         "libnotify"
    
      28         "gsettings-desktop-schemas"
    
      29         "libxres"
    
      30         "libglvnd"
    
      31        )
    
      32optdepends=('gnome-keyring: Fixses startup in Gmome. Store passwords and encryption keys.' 'hicolor-icon-theme')
    
      33options=('!strip' '!debug')
    
      34
    
      35_app_name="MAX"
    
      36_filename="${_app_name}-${pkgver}.rpm"
    
      37
    
      38provides=("${pkgname%-bin}")
    
      39conflicts=("${pkgname%-bin}")
    
      40
    
      41source_x86_64=("https://download.max.ru/linux/rpm/el/9/${arch}/${_filename}")
    
      42
    
      43sha256sums_x86_64=('3a2caba0cc47682f8b9708406323eab7d9ed54a2061abeeb8f63b00ed30b4e5a')
    
      44
    
      45package() {
    
      46    cp -a "${srcdir}/usr/"  "${pkgdir}/usr/"
    
      47    mkdir -p "${pkgdir}/usr/bin/"
    
      48    ln -sf "/usr/share/max/bin/max" "${pkgdir}/usr/bin/max"
    
      49    #Temporary fix for the app to work with calls (rename the libraries that come with the app so that the system ones are used instead).
    
      50    mv "${pkgdir}/usr/share/max/bin/max-service/lib64/libsystemd.so.0" "${pkgdir}/usr/share/max/bin/max-service/lib64/libsystemd.so.0.bak"
    
      51    mv "${pkgdir}/usr/share/max/bin/max-service/lib64/libpcre2-8.so.0" "${pkgdir}/usr/share/max/bin/max-service/lib64/libpcre2-8.so.0.bak"
    
      52}
    
      53

Changes since previous scan

--- PKGBUILD @ 2026-10-31 00:07
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: KUHTOXO https://aur.archlinux.org/account/kuhtoxo
 
 pkgname=max-bin
-pkgver=26.36.0.81334
+pkgver=26.38.0.82021
 pkgrel=1
 
 pkgdesc="MAX messenger."
@@ -40,13 +40,12 @@
 
 source_x86_64=("https://download.max.ru/linux/rpm/el/9/${arch}/${_filename}")
 
-sha256sums_x86_64=('d6897dbb85936710cbdefed60c5b296807b9e2fe395a9a54b4cbed367a95be7d')
+sha256sums_x86_64=('3a2caba0cc47682f8b9708406323eab7d9ed54a2061abeeb8f63b00ed30b4e5a')
 
 package() {
     cp -a "${srcdir}/usr/"  "${pkgdir}/usr/"
     mkdir -p "${pkgdir}/usr/bin/"
     ln -sf "/usr/share/max/bin/max" "${pkgdir}/usr/bin/max"
-    
     #Temporary fix for the app to work with calls (rename the libraries that come with the app so that the system ones are used instead).
     mv "${pkgdir}/usr/share/max/bin/max-service/lib64/libsystemd.so.0" "${pkgdir}/usr/share/max/bin/max-service/lib64/libsystemd.so.0.bak"
     mv "${pkgdir}/usr/share/max/bin/max-service/lib64/libpcre2-8.so.0" "${pkgdir}/usr/share/max/bin/max-service/lib64/libpcre2-8.so.0.bak"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 15:58:34	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 17:46:00	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2