minimax-hub

MEDIUM

maintainer duanluan 0 votes scanned 2026-08-21 21:19:14.007822

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt macOS app from filecdn.minimax.chat (a CDN that could be swapped), extracts and repacks its asar, then runs 'npx --yes @electron/rebuild' which fetches and executes a package from the npm registry at build time; while the npm package is a well-known official Electron tool and the CDN appears to be MiniMax's own infrastructure, the combination of a non-standard CDN host for a proprietary binary and a live npx execution introduces supply-chain risk beyond a pure source build.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:135 npx --yes @electron/rebuild -v "${_electron_major}.0.0" --force \

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 "MiniMax-Hub-${pkgver}-mac-x64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.15/hilo-desktop-870/MiniMax%20Design-2.0.15-mac.zip"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): The PKGBUILD downloads a prebuilt macOS app from filecdn.minimax.chat (a CDN that could be swapped), extracts and repacks its asar, then runs 'npx --yes @electron/rebuild' which fetches and executes a package from the npm registry at build time; while the npm package is a well-known official Electron tool and the CDN appears to be MiniMax's own infrastructure, the combination of a non-standard CDN host for a proprietary binary and a live npx execution introduces supply-chain risk beyond a pure source build.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=minimax-hub
    
      4_pkgname=minimax-hub
    
      5pkgver=2.0.15
    
      6pkgrel=6
    
      7pkgdesc='MiniMax Hub desktop app repackaged from the official macOS release'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://hub.minimaxi.com/'
    
      10license=('LicenseRef-Proprietary')
    
      11depends=(
    
      12  'electron39'
    
      13  'ffmpeg'
    
      14  'hicolor-icon-theme'
    
      15  'nodejs'
    
      16  'xdg-utils'
    
      17)
    
      18optdepends=(
    
      19  'opencode: OpenCode runtime from the Arch repositories'
    
      20  'npm: install opencode-ai globally as an alternative OpenCode runtime'
    
      21)
    
      22makedepends=(
    
      23  '7zip'
    
      24  'asar'
    
      25  'nodejs'
    
      26  'npm'
    
      27  'python'
    
      28)
    
      29provides=("minimax-hub-bin=${pkgver}")
    
      30options=('!strip' '!lto')
    
      31install='minimax-hub.install'
    
      32source=(
    
      33  'minimax-hub.sh'
    
      34  'minimax-hub.desktop'
    
      35  'patch-linux-runtime.mjs'
    
      36  'minimax-hub.install'
    
      37  'LICENSE'
    
      38)
    
      39source_x86_64=(
    
      40  "MiniMax-Hub-${pkgver}-mac-x64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.15/hilo-desktop-870/MiniMax%20Design-2.0.15-mac.zip"
    
      41)
    
      42source_aarch64=(
    
      43  "MiniMax-Hub-${pkgver}-mac-arm64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.15/hilo-desktop-870/MiniMax%20Design-2.0.15-arm64-mac.zip"
    
      44)
    
      45noextract=(
    
      46  "MiniMax-Hub-${pkgver}-mac-x64.zip"
    
      47  "MiniMax-Hub-${pkgver}-mac-arm64.zip"
    
      48)
    
      49sha256sums=('4e8ac22b373c6290dbd80576df9d9bec4203d1aafc4fbbbdb33e556966de5e04'
    
      50            '4c9da9d8bab463dbd04b4320c1a2f2b4dfc885e2e4a1a53955fb328e1a271329'
    
      51            '9d78784df2f0854fdf08d436c22501adff17068de77ae584254045e51c041490'
    
      52            '20bcf5b029a2b88bd1027207f287e44d87586d2dac6e82ac66174141f9fb928b'
    
      53            'a95f4a1bb7d5ba464ca8503549fa98a6d6bdfc667af0a9265f6b01416f85de96')
    
      54sha256sums_x86_64=('c3b2487920da71ee6e5242077d0fa79012f990f69a9325f57d1e285bac153a11')
    
      55sha256sums_aarch64=('64e4cdaa0f094ffb59cb913ff4af026874df3fb9d78ce9015a91882d9fe26538')
    
      56
    
      57_electron_major=39
    
      58
    
      59prepare() {
    
      60  cd "${srcdir}"
    
      61  rm -rf upstream-app app-extracted app.asar resources native-build
    
      62  mkdir upstream-app resources
    
      63
    
      64  local archive_file appdir
    
      65  case "${CARCH}" in
    
      66    x86_64)
    
      67      archive_file="MiniMax-Hub-${pkgver}-mac-x64.zip"
    
      68      ;;
    
      69    aarch64)
    
      70      archive_file="MiniMax-Hub-${pkgver}-mac-arm64.zip"
    
      71      ;;
    
      72    *)
    
      73      echo "Unsupported architecture: ${CARCH}" >&2
    
      74      return 1
    
      75      ;;
    
      76  esac
    
      77
    
      78  7z x -bd -y "${archive_file}" -oupstream-app >/dev/null
    
      79
    
      80  appdir="$(find upstream-app -path '*/MiniMax Hub.app' -type d -print -quit)"
    
      81
    
      82  [[ -n "${appdir}" && -d "${appdir}" ]] || {
    
      83    echo "Could not find MiniMax Hub.app in upstream archive" >&2
    
      84    return 1
    
      85  }
    
      86
    
      87  local upstream_resources="${appdir}/Contents/Resources"
    
      88
    
      89  asar extract "${upstream_resources}/app.asar" app-extracted
    
      90  node "${srcdir}/patch-linux-runtime.mjs" app-extracted
    
      91  asar pack app-extracted app.asar
    
      92
    
      93  cp -a \
    
      94    "${upstream_resources}/app-resources" \
    
      95    "${upstream_resources}/conf" \
    
      96    "${upstream_resources}/gateway" \
    
      97    "${upstream_resources}/mcp-tools" \
    
      98    "${upstream_resources}/opencode" \
    
      99    "${upstream_resources}/opencode-plugin-hilo" \
    
      100    "${upstream_resources}/opencode-plugin-trace" \
    
      101    resources/
    
      102
    
      103  install -Dm644 "${upstream_resources}/app-update.yml" \
    
      104    resources/app-update.yml
    
      105
    
      106  rm -rf resources/ffmpeg
    
      107  install -dm755 resources/ffmpeg
    
      108  ln -s /usr/bin/ffmpeg resources/ffmpeg/ffmpeg
    
      109  ln -s /usr/bin/ffprobe resources/ffmpeg/ffprobe
    
      110
    
      111  rm -f resources/opencode/opencode
    
      112  ln -s /usr/bin/opencode resources/opencode/opencode
    
      113
    
      114  find resources \
    
      115    \( -name '.DS_Store' -o -name '._*' -o -name '*:com.apple.*' \) \
    
      116    -delete
    
      117
    
      118  cd "${srcdir}/resources/gateway"
    
      119  npm install \
    
      120    --ignore-scripts \
    
      121    --no-audit \
    
      122    --no-fund \
    
      123    --omit=dev \
    
      124    "better-sqlite3@12.9.0" \
    
      125    "@node-rs/xxhash@1.7.6" \
    
      126    "sharp@0.34.5" \
    
      127    "undici@8.5.0" \
    
      128    "ws@8.21.0"
    
      129
    
      130  export npm_config_runtime=electron
    
      131  export npm_config_target="${_electron_major}.0.0"
    
      132  export npm_config_disturl='https://electronjs.org/headers'
    
      133  export npm_config_build_from_source=true
    
      134
    
      135  npx --yes @electron/rebuild -v "${_electron_major}.0.0" --force \
    
      136    -m "${srcdir}/resources/gateway"
    
      137
    
      138  find "${srcdir}/resources/gateway/node_modules" \
    
      139    \( -path '*/.prepack-darwin-*' -o -path '*/bin/darwin-*' -o -path '*/@img/sharp-darwin-*' -o -path '*/@img/sharp-libvips-darwin-*' -o -path '*/@node-rs/xxhash-darwin-*' \) \
    
      140    -prune -exec rm -rf '{}' +
    
      141
    
      142  find "${srcdir}/resources/gateway/node_modules" \
    
      143    -type f \( -name Makefile -o -name '*.mk' -o -name config.gypi \) \
    
      144    -delete
    
      145  find "${srcdir}/resources/gateway/node_modules" \
    
      146    -type d -name .deps -prune -exec rm -rf '{}' +
    
      147}
    
      148
    
      149package() {
    
      150  cd "${srcdir}"
    
      151
    
      152  install -dm755 \
    
      153    "${pkgdir}/usr/bin" \
    
      154    "${pkgdir}/usr/lib/${pkgname}/resources" \
    
      155    "${pkgdir}/usr/share/applications" \
    
      156    "${pkgdir}/usr/share/doc/${pkgname}" \
    
      157    "${pkgdir}/usr/share/icons/hicolor/512x512/apps" \
    
      158    "${pkgdir}/usr/share/licenses/${pkgname}"
    
      159
    
      160  install -Dm755 "${srcdir}/minimax-hub.sh" \
    
      161    "${pkgdir}/usr/bin/minimax-hub"
    
      162  install -Dm644 "${srcdir}/minimax-hub.desktop" \
    
      163    "${pkgdir}/usr/share/applications/minimax-hub.desktop"
    
      164
    
      165  install -Dm644 app.asar \
    
      166    "${pkgdir}/usr/lib/${pkgname}/resources/app.asar"
    
      167  cp -a resources/. \
    
      168    "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      169  find "${pkgdir}/usr/lib/${pkgname}/resources" -type d -exec chmod 755 '{}' +
    
      170  find "${pkgdir}/usr/lib/${pkgname}/resources" -type f -perm /111 -exec chmod 755 '{}' +
    
      171  find "${pkgdir}/usr/lib/${pkgname}/resources" -type f ! -perm /111 -exec chmod 644 '{}' +
    
      172
    
      173  install -Dm644 resources/app-resources/icon.png \
    
      174    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/minimax-hub.png"
    
      175  install -Dm644 app-extracted/package.json \
    
      176    "${pkgdir}/usr/share/doc/${pkgname}/package.json"
    
      177  install -Dm644 "${srcdir}/LICENSE" \
    
      178    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      179}
    
      180

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-21 21:19:14	Medium	4
2026-08-21 21:15:20	Medium	3