minimax-design

MEDIUM

maintainer duanluan 0 votes scanned 2026-10-20 05:29:37.804337

View on AUR

Why flagged

The package downloads a macOS app binary from a non-standard CDN host (filecdn.minimax.chat) and repacks it for Linux, which is a legitimate but unverifiable repackaging approach; additionally, `npx --yes @electron/rebuild` fetches and executes a remote npm package at build time, though this is a well-known official Electron tool. The checksums are pinned, reducing swap risk, but the combination of a non-official CDN source for a proprietary binary plus remote npx execution warrants medium concern.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:134 npx --yes @electron/rebuild -v "${_electron_major}.0.0" --force \

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:39 "MiniMax-Design-${pkgver}-mac-x64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.15/hilo-desktop-870/MiniMax%20Design-2.0.15-mac.zip"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): The package downloads a macOS app binary from a non-standard CDN host (filecdn.minimax.chat) and repacks it for Linux, which is a legitimate but unverifiable repackaging approach; additionally, `npx --yes @electron/rebuild` fetches and executes a remote npm package at build time, though this is a well-known official Electron tool. The checksums are pinned, reducing swap risk, but the combination of a non-official CDN source for a proprietary binary plus remote npx execution warrants medium concern.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=minimax-design
    
      4pkgver=2.0.15
    
      5pkgrel=1
    
      6pkgdesc='MiniMax Design desktop app repackaged from the official macOS release'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://design.minimax.cn/'
    
      9license=('LicenseRef-Proprietary')
    
      10depends=(
    
      11  'electron39'
    
      12  'ffmpeg'
    
      13  'hicolor-icon-theme'
    
      14  'nodejs'
    
      15  'xdg-utils'
    
      16)
    
      17optdepends=(
    
      18  'opencode: OpenCode runtime from the Arch repositories'
    
      19  'npm: install opencode-ai globally as an alternative OpenCode runtime'
    
      20)
    
      21makedepends=(
    
      22  '7zip'
    
      23  'asar'
    
      24  'nodejs'
    
      25  'npm'
    
      26  'python'
    
      27)
    
      28provides=("minimax-hub=${pkgver}" "minimax-hub-bin=${pkgver}")
    
      29options=('!strip' '!lto')
    
      30install='minimax-design.install'
    
      31source=(
    
      32  'minimax-design.sh'
    
      33  'minimax-design.desktop'
    
      34  'patch-linux-runtime.mjs'
    
      35  'minimax-design.install'
    
      36  'LICENSE'
    
      37)
    
      38source_x86_64=(
    
      39  "MiniMax-Design-${pkgver}-mac-x64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.15/hilo-desktop-870/MiniMax%20Design-2.0.15-mac.zip"
    
      40)
    
      41source_aarch64=(
    
      42  "MiniMax-Design-${pkgver}-mac-arm64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.15/hilo-desktop-870/MiniMax%20Design-2.0.15-arm64-mac.zip"
    
      43)
    
      44noextract=(
    
      45  "MiniMax-Design-${pkgver}-mac-x64.zip"
    
      46  "MiniMax-Design-${pkgver}-mac-arm64.zip"
    
      47)
    
      48sha256sums=('def0923a361edfd578f0a11861032724e2b95ac04e9f4833caeaf5f6a315367c'
    
      49            '04eaa2c9557b58eb738976a3680b5c2150edc6df5773be3e02ee24c8a53a1ca9'
    
      50            '9d78784df2f0854fdf08d436c22501adff17068de77ae584254045e51c041490'
    
      51            '89b42c67b2ecc25a0603eb43d1f5ee43e2c715623b32de16b6caa6860d0ad99c'
    
      52            'a95f4a1bb7d5ba464ca8503549fa98a6d6bdfc667af0a9265f6b01416f85de96')
    
      53sha256sums_x86_64=('c3b2487920da71ee6e5242077d0fa79012f990f69a9325f57d1e285bac153a11')
    
      54sha256sums_aarch64=('64e4cdaa0f094ffb59cb913ff4af026874df3fb9d78ce9015a91882d9fe26538')
    
      55
    
      56_electron_major=39
    
      57
    
      58prepare() {
    
      59  cd "${srcdir}"
    
      60  rm -rf upstream-app app-extracted app.asar resources native-build
    
      61  mkdir upstream-app resources
    
      62
    
      63  local archive_file appdir
    
      64  case "${CARCH}" in
    
      65    x86_64)
    
      66      archive_file="MiniMax-Design-${pkgver}-mac-x64.zip"
    
      67      ;;
    
      68    aarch64)
    
      69      archive_file="MiniMax-Design-${pkgver}-mac-arm64.zip"
    
      70      ;;
    
      71    *)
    
      72      echo "Unsupported architecture: ${CARCH}" >&2
    
      73      return 1
    
      74      ;;
    
      75  esac
    
      76
    
      77  7z x -bd -y "${archive_file}" -oupstream-app >/dev/null
    
      78
    
      79  appdir="$(find upstream-app -path '*/MiniMax Hub.app' -type d -print -quit)"
    
      80
    
      81  [[ -n "${appdir}" && -d "${appdir}" ]] || {
    
      82    echo "Could not find MiniMax Hub.app in upstream archive" >&2
    
      83    return 1
    
      84  }
    
      85
    
      86  local upstream_resources="${appdir}/Contents/Resources"
    
      87
    
      88  asar extract "${upstream_resources}/app.asar" app-extracted
    
      89  node "${srcdir}/patch-linux-runtime.mjs" app-extracted
    
      90  asar pack app-extracted app.asar
    
      91
    
      92  cp -a \
    
      93    "${upstream_resources}/app-resources" \
    
      94    "${upstream_resources}/conf" \
    
      95    "${upstream_resources}/gateway" \
    
      96    "${upstream_resources}/mcp-tools" \
    
      97    "${upstream_resources}/opencode" \
    
      98    "${upstream_resources}/opencode-plugin-hilo" \
    
      99    "${upstream_resources}/opencode-plugin-trace" \
    
      100    resources/
    
      101
    
      102  install -Dm644 "${upstream_resources}/app-update.yml" \
    
      103    resources/app-update.yml
    
      104
    
      105  rm -rf resources/ffmpeg
    
      106  install -dm755 resources/ffmpeg
    
      107  ln -s /usr/bin/ffmpeg resources/ffmpeg/ffmpeg
    
      108  ln -s /usr/bin/ffprobe resources/ffmpeg/ffprobe
    
      109
    
      110  rm -f resources/opencode/opencode
    
      111  ln -s /usr/bin/opencode resources/opencode/opencode
    
      112
    
      113  find resources \
    
      114    \( -name '.DS_Store' -o -name '._*' -o -name '*:com.apple.*' \) \
    
      115    -delete
    
      116
    
      117  cd "${srcdir}/resources/gateway"
    
      118  npm install \
    
      119    --ignore-scripts \
    
      120    --no-audit \
    
      121    --no-fund \
    
      122    --omit=dev \
    
      123    "better-sqlite3@12.9.0" \
    
      124    "@node-rs/xxhash@1.7.6" \
    
      125    "sharp@0.34.5" \
    
      126    "undici@8.5.0" \
    
      127    "ws@8.21.0"
    
      128
    
      129  export npm_config_runtime=electron
    
      130  export npm_config_target="${_electron_major}.0.0"
    
      131  export npm_config_disturl='https://electronjs.org/headers'
    
      132  export npm_config_build_from_source=true
    
      133
    
      134  npx --yes @electron/rebuild -v "${_electron_major}.0.0" --force \
    
      135    -m "${srcdir}/resources/gateway"
    
      136
    
      137  find "${srcdir}/resources/gateway/node_modules" \
    
      138    \( -path '*/.prepack-darwin-*' -o -path '*/bin/darwin-*' -o -path '*/@img/sharp-darwin-*' -o -path '*/@img/sharp-libvips-darwin-*' -o -path '*/@node-rs/xxhash-darwin-*' \) \
    
      139    -prune -exec rm -rf '{}' +
    
      140
    
      141  find "${srcdir}/resources/gateway/node_modules" \
    
      142    -type f \( -name Makefile -o -name '*.mk' -o -name config.gypi \) \
    
      143    -delete
    
      144  find "${srcdir}/resources/gateway/node_modules" \
    
      145    -type d -name .deps -prune -exec rm -rf '{}' +
    
      146}
    
      147
    
      148package() {
    
      149  cd "${srcdir}"
    
      150
    
      151  install -dm755 \
    
      152    "${pkgdir}/usr/bin" \
    
      153    "${pkgdir}/usr/lib/${pkgname}/resources" \
    
      154    "${pkgdir}/usr/share/applications" \
    
      155    "${pkgdir}/usr/share/doc/${pkgname}" \
    
      156    "${pkgdir}/usr/share/icons/hicolor/512x512/apps" \
    
      157    "${pkgdir}/usr/share/licenses/${pkgname}"
    
      158
    
      159  install -Dm755 "${srcdir}/minimax-design.sh" \
    
      160    "${pkgdir}/usr/bin/minimax-design"
    
      161  install -Dm644 "${srcdir}/minimax-design.desktop" \
    
      162    "${pkgdir}/usr/share/applications/minimax-design.desktop"
    
      163
    
      164  install -Dm644 app.asar \
    
      165    "${pkgdir}/usr/lib/${pkgname}/resources/app.asar"
    
      166  cp -a resources/. \
    
      167    "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      168  find "${pkgdir}/usr/lib/${pkgname}/resources" -type d -exec chmod 755 '{}' +
    
      169  find "${pkgdir}/usr/lib/${pkgname}/resources" -type f -perm /111 -exec chmod 755 '{}' +
    
      170  find "${pkgdir}/usr/lib/${pkgname}/resources" -type f ! -perm /111 -exec chmod 644 '{}' +
    
      171
    
      172  install -Dm644 resources/app-resources/icon.png \
    
      173    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/minimax-design.png"
    
      174  install -Dm644 app-extracted/package.json \
    
      175    "${pkgdir}/usr/share/doc/${pkgname}/package.json"
    
      176  install -Dm644 "${srcdir}/LICENSE" \
    
      177    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      178}
    
      179

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 05:29:37	Medium	4
2026-10-20 05:27:35	Medium	4