mdai-bin

MEDIUM

maintainer GoranArch 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

A prebuilt proprietary binary is downloaded from dl.mdai.me, a non-whitelisted personal/project host unrelated to any major forge or vendor CDN; while the checksum is present and the host appears to be the project's own domain, the binary is unverifiable and could be silently swapped, which warrants medium severity for a low-vote, recently uploaded package.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("${pkgname}-${pkgver}.tar.gz::https://dl.mdai.me/mdai_${pkgver}_x86_64-linux.tar.gz"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 72%): A prebuilt proprietary binary is downloaded from dl.mdai.me, a non-whitelisted personal/project host unrelated to any major forge or vendor CDN; while the checksum is present and the host appears to be the project's own domain, the binary is unverifiable and could be silently swapped, which warrants medium severity for a low-vote, recently uploaded package.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Goran Jovanovic
    
      2# mdai-bin: gotov Linux binar (bez updatera; azurira pacman).
    
      3# sha256 tarbala i .SRCINFO se popunjavaju u AUR klonu pri izdanju
    
      4# (docs/RELEASE-CHECKLIST.md 3h).
    
      5pkgname=mdai-bin
    
      6pkgver=1.2.5
    
      7pkgrel=1
    
      8pkgdesc="Local-first Markdown editor with BYOK AI (proprietary, binary)"
    
      9arch=(x86_64)
    
      10url="https://mdai.me"
    
      11license=(LicenseRef-proprietary)
    
      12depends=(webkit2gtk-4.1 gtk3 libsoup3 glib2 cairo gdk-pixbuf2 dbus hicolor-icon-theme glibc gcc-libs zlib)
    
      13optdepends=("hunspell-en_us: spell checking (English)")
    
      14provides=(mdai)
    
      15conflicts=(mdai)
    
      16options=(!strip !debug)
    
      17source=("${pkgname}-${pkgver}.tar.gz::https://dl.mdai.me/mdai_${pkgver}_x86_64-linux.tar.gz"
    
      18        mdai.sh)
    
      19sha256sums=(3e3881796fb425095a0d9578006156489339473ab8e04e8deec460a3c1d19cfc
    
      20            f72eed84ccf15e7bbbefa8f64eb3203bbdaeb26dd6b8ed645e299ea83050c1e2)
    
      21package() {
    
      22  # pravi binar u /usr/lib/mdai, a /usr/bin/mdai je omotac (mdai.sh)
    
      23  install -Dm755 mdai "$pkgdir/usr/lib/mdai/mdai"
    
      24  install -Dm755 mdai.sh "$pkgdir/usr/bin/mdai"
    
      25  install -Dm644 mdai.png "$pkgdir/usr/share/icons/hicolor/128x128/apps/mdai.png"
    
      26  install -Dm644 mdai-256.png "$pkgdir/usr/share/icons/hicolor/256x256/apps/mdai.png"
    
      27  install -Dm644 mdai.desktop "$pkgdir/usr/share/applications/mdai.desktop"
    
      28  install -Dm644 EULA.md "$pkgdir/usr/share/licenses/$pkgname/EULA.md"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Medium	3
2026-10-06 00:13:36	Low	3
2026-10-05 23:40:58	Medium	2