meowpad-configurator-v2-bin

maintainer MingxuanGame · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from assets.desu.life, which is the project's own asset hosting domain (matching the url= field and the GitHub org 'desu-life'). This is a common pattern for AUR -bin packages that host releases on their own CDN rather than GitHub Releases. However, assets.desu.life is not a widely recognized or auditable release platform, and the binary is executed directly on the user's system after extraction. The SHA256 checksum provides integrity protection against transit tampering, but does not protect against a compromised upstream host serving a malicious binary. This is a standard medium-severity supply-chain concern for -bin packages from personal/project CDNs: not clearly malicious, but the trust anchor is a single domain controlled by the maintainer with no independent verification. The udev rules installation and webkit2gtk dependency are consistent with a legitimate hardware configurator application (Meowpad is a known mechanical keyboard accessory). No obfuscation, no piracy, no broken build steps detected.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "MeowpadConifiguratorForV2_v${pkgver}_linux.deb::https://assets.desu.life/device/app/resources/MeowpadConfiguratorForV2_v${pkgver}_linux.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from assets.desu.life, which is the project's own asset hosting domain (matching the url= field and the GitHub org 'desu-life'). This is a common pattern for AUR -bin packages that host releases on their own CDN rather than GitHub Releases. However, assets.desu.life is not a widely recognized or auditable release platform, and the binary is executed directly on the user's system after extraction. The SHA256 checksum provides integrity protection against transit tampering, but does not protect against a compromised upstream host serving a malicious binary. This is a standard medium-severity supply-chain concern for -bin packages from personal/project CDNs: not clearly malicious, but the trust anchor is a single domain controlled by the maintainer with no independent verification. The udev rules installation and webkit2gtk dependency are consistent with a legitimate hardware configurator application (Meowpad is a known mechanical keyboard accessory). No obfuscation, no piracy, no broken build steps detected.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: MingxuanGame <MingxuanGame@outlook.com>
    
      2# Maintainer: serverbread <serverbread-DEV@qq.com>
    
      3pkgname="meowpad-configurator-v2-bin"
    
      4pkgver="1.2.0"
    
      5pkgrel=1
    
      6pkgdesc="Meowpad v2 配置器"
    
      7arch=('x86_64')
    
      8license=('MIT')
    
      9url="https://desu.life/"
    
      10depends=(    
    
      11  'webkit2gtk-4.1'
    
      12  'gtk3'
    
      13  'systemd-libs'
    
      14  'openssl-1.1'
    
      15  'gdk-pixbuf2'
    
      16  'gcc-libs'
    
      17  'libsoup'
    
      18  'glibc'
    
      19  'glib2'
    
      20  'hicolor-icon-theme'
    
      21)
    
      22makedepends=(
    
      23  'binutils'
    
      24)
    
      25provides=("meowpad-configurator-v2")
    
      26conflicts=("meowpad-configurator-v2" "meowpad-configurator-v2-git")
    
      27options=('!emptydirs')
    
      28install='udev.install'
    
      29source=(
    
      30  "MeowpadConifiguratorForV2_v${pkgver}_linux.deb::https://assets.desu.life/device/app/resources/MeowpadConfiguratorForV2_v${pkgver}_linux.deb"
    
      31  '52-meowpad.rules'
    
      32  'LICENSE::https://raw.githubusercontent.com/desu-life/MeowpadConfigurator/refs/heads/2.0-meowpad/LICENSE'
    
      33  'udev.install'
    
      34)
    
      35sha256sums=(
    
      36  'e174530e49cb05d2f08878f05f0e14246198d7e314398601dbba64422ef759e2'
    
      37  '5c399802e5cb6e55ab13058e3474ea9c3b67601bdefb5da85061e3628e862428'
    
      38  '20572bbf6ce7d98829f48e0281a2109469f6b3068e814d10400066014deee9c5'
    
      39  '97ed0869cf8d327096c734d070c588838913c189187f3c439e07dc368b984fde'
    
      40)
    
      41
    
      42package(){
    
      43  cd "$srcdir"
    
      44  ar x "MeowpadConifiguratorForV2_v${pkgver}_linux.deb"
    
      45  tar xf data.tar.gz -C "$pkgdir"
    
      46  install -Dm 644 "$srcdir/52-meowpad.rules" "$pkgdir"/usr/lib/udev/rules.d/52-meowpad.rules
    
      47  install -Dm 644 "LICENSE" "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      48  rm -rf "$pkgdir/usr/src"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2