mimocode

maintainer spiriwind · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Installs a prebuilt binary (mimo) from Xiaomi's CDN (mi-fds.com) with SKIP'd checksum, making it unverifiable; while the host appears to be Xiaomi's official file distribution service, all checksums are skipped so any tampering would go undetected, and the binary is executed directly rather than built from source.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://mimocode.cnbj1.mi-fds.com/mimocode/mimocode/releases/v${pkgver}/mimocode-linux-x64.tar.gz"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Installs a prebuilt binary (mimo) from Xiaomi's CDN (mi-fds.com) with SKIP'd checksum, making it unverifiable; while the host appears to be Xiaomi's official file distribution service, all checksums are skipped so any tampering would go undetected, and the binary is executed directly rather than built from source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: spiriwind <ruiting_mail@qq.com>
    
      2pkgname=mimocode
    
      3pkgver=0.1.9
    
      4pkgrel=1
    
      5pkgdesc="AI-powered CLI coding agent by Xiaomi MiMo Team"
    
      6arch=('x86_64')
    
      7url="https://mimo.xiaomi.com/coder"
    
      8license=('MIT')
    
      9options=('!strip')
    
      10depends=('nodejs>=18')
    
      11optdepends=('sox: voice input support')
    
      12install="$pkgname.install"
    
      13# Official FDS source (same as https://mimo.xiaomi.com/install script)
    
      14source=("https://mimocode.cnbj1.mi-fds.com/mimocode/mimocode/releases/v${pkgver}/mimocode-linux-x64.tar.gz"
    
      15        "mimocode.bash"
    
      16        "mimocode.fish"
    
      17        "mimocode.1"
    
      18        "mimocode.zh_CN.1")
    
      19sha256sums=('SKIP'
    
      20           'SKIP'
    
      21           'SKIP'
    
      22           'SKIP'
    
      23           'SKIP')
    
      24
    
      25package() {
    
      26    # Binary
    
      27    install -Dm755 "$srcdir/mimo" "$pkgdir/usr/bin/mimo"
    
      28
    
      29    # Bash completion
    
      30    install -Dm644 "$srcdir/mimocode.bash" "$pkgdir/usr/share/bash-completion/completions/mimo"
    
      31
    
      32    # Fish completion
    
      33    install -Dm644 "$srcdir/mimocode.fish" "$pkgdir/usr/share/fish/vendor_completions.d/mimo.fish"
    
      34
    
      35    # Man pages
    
      36    install -Dm644 "$srcdir/mimocode.1" "$pkgdir/usr/share/man/man1/mimo.1"
    
      37    install -Dm644 "$srcdir/mimocode.zh_CN.1" "$pkgdir/usr/share/man/zh_CN/man1/mimo.1"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 03:37:00	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 17:39:18	MEDIUM	3
2026-07-27 17:35:03	MEDIUM	2