minimax-hub-bin

maintainer duanluan · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package repackages an official macOS release from the vendor's own domain, uses npx for rebuilding native modules against Electron (a normal step in Electron app packaging), and installs only static assets and prebuilt binaries; the non-whitelisted host is the vendor's own CDN, and no untrusted remote code execution occurs.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package repackages an official macOS release from the vendor's own domain, uses npx for rebuilding native modules against Electron (a normal step in Electron app packaging), and installs only static assets and prebuilt binaries; the non-whitelisted host is the vendor's own CDN, and no untrusted remote code execution occurs.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:136 npx --yes @electron/rebuild -v "${_electron_major}.0.0" --force \

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 "MiniMax-Hub-${pkgver}-mac-x64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.8/hilo-desktop-779/MiniMax%20Hub-2.0.8-mac.zip"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=minimax-hub-bin
    
      4_pkgname=minimax-hub
    
      5pkgver=2.0.8
    
      6pkgrel=6
    
      7pkgdesc='MiniMax Hub desktop app repackaged from the official macOS release'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://hub.minimaxi.com/'
    
      10license=('custom:proprietary')
    
      11depends=(
    
      12  'electron39'
    
      13  'ffmpeg'
    
      14  'hicolor-icon-theme'
    
      15  'nodejs'
    
      16  'xdg-utils'
    
      17)
    
      18optdepends=(
    
      19  'opencode: OpenCode runtime from the Arch repositories'
    
      20  'npm: install opencode-ai globally as an alternative OpenCode runtime'
    
      21)
    
      22makedepends=(
    
      23  '7zip'
    
      24  'asar'
    
      25  'nodejs'
    
      26  'npm'
    
      27  'python'
    
      28)
    
      29provides=('minimax-hub')
    
      30conflicts=('minimax-hub')
    
      31options=('!strip' '!lto')
    
      32install='minimax-hub-bin.install'
    
      33source=(
    
      34  'minimax-hub.sh'
    
      35  'minimax-hub.desktop'
    
      36  'patch-linux-runtime.mjs'
    
      37  'minimax-hub-bin.install'
    
      38  'LICENSE'
    
      39)
    
      40source_x86_64=(
    
      41  "MiniMax-Hub-${pkgver}-mac-x64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.8/hilo-desktop-779/MiniMax%20Hub-2.0.8-mac.zip"
    
      42)
    
      43source_aarch64=(
    
      44  "MiniMax-Hub-${pkgver}-mac-arm64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.8/hilo-desktop-779/MiniMax%20Hub-2.0.8-arm64-mac.zip"
    
      45)
    
      46noextract=(
    
      47  "MiniMax-Hub-${pkgver}-mac-x64.zip"
    
      48  "MiniMax-Hub-${pkgver}-mac-arm64.zip"
    
      49)
    
      50sha256sums=('4e8ac22b373c6290dbd80576df9d9bec4203d1aafc4fbbbdb33e556966de5e04'
    
      51            '4c9da9d8bab463dbd04b4320c1a2f2b4dfc885e2e4a1a53955fb328e1a271329'
    
      52            '9d78784df2f0854fdf08d436c22501adff17068de77ae584254045e51c041490'
    
      53            '20bcf5b029a2b88bd1027207f287e44d87586d2dac6e82ac66174141f9fb928b'
    
      54            'a95f4a1bb7d5ba464ca8503549fa98a6d6bdfc667af0a9265f6b01416f85de96')
    
      55sha256sums_x86_64=('992d7b6944cc76041ddfb3841e1a087b55fdc1b51c69f0ad92c0340429d98f2e')
    
      56sha256sums_aarch64=('48a3d1a5476cf92e4df6475602ea5c3abb6cffc58ed0cb572f7d8ffad7a46c90')
    
      57
    
      58_electron_major=39
    
      59
    
      60prepare() {
    
      61  cd "${srcdir}"
    
      62  rm -rf upstream-app app-extracted app.asar resources native-build
    
      63  mkdir upstream-app resources
    
      64
    
      65  local archive_file appdir
    
      66  case "${CARCH}" in
    
      67    x86_64)
    
      68      archive_file="MiniMax-Hub-${pkgver}-mac-x64.zip"
    
      69      ;;
    
      70    aarch64)
    
      71      archive_file="MiniMax-Hub-${pkgver}-mac-arm64.zip"
    
      72      ;;
    
      73    *)
    
      74      echo "Unsupported architecture: ${CARCH}" >&2
    
      75      return 1
    
      76      ;;
    
      77  esac
    
      78
    
      79  7z x -bd -y "${archive_file}" -oupstream-app >/dev/null
    
      80
    
      81  appdir="$(find upstream-app -path '*/MiniMax Hub.app' -type d -print -quit)"
    
      82
    
      83  [[ -n "${appdir}" && -d "${appdir}" ]] || {
    
      84    echo "Could not find MiniMax Hub.app in upstream archive" >&2
    
      85    return 1
    
      86  }
    
      87
    
      88  local upstream_resources="${appdir}/Contents/Resources"
    
      89
    
      90  asar extract "${upstream_resources}/app.asar" app-extracted
    
      91  node "${srcdir}/patch-linux-runtime.mjs" app-extracted
    
      92  asar pack app-extracted app.asar
    
      93
    
      94  cp -a \
    
      95    "${upstream_resources}/app-resources" \
    
      96    "${upstream_resources}/conf" \
    
      97    "${upstream_resources}/gateway" \
    
      98    "${upstream_resources}/mcp-tools" \
    
      99    "${upstream_resources}/opencode" \
    
      100    "${upstream_resources}/opencode-plugin-hilo" \
    
      101    "${upstream_resources}/opencode-plugin-trace" \
    
      102    resources/
    
      103
    
      104  install -Dm644 "${upstream_resources}/app-update.yml" \
    
      105    resources/app-update.yml
    
      106
    
      107  rm -rf resources/ffmpeg
    
      108  install -dm755 resources/ffmpeg
    
      109  ln -s /usr/bin/ffmpeg resources/ffmpeg/ffmpeg
    
      110  ln -s /usr/bin/ffprobe resources/ffmpeg/ffprobe
    
      111
    
      112  rm -f resources/opencode/opencode
    
      113  ln -s /usr/bin/opencode resources/opencode/opencode
    
      114
    
      115  find resources \
    
      116    \( -name '.DS_Store' -o -name '._*' -o -name '*:com.apple.*' \) \
    
      117    -delete
    
      118
    
      119  cd "${srcdir}/resources/gateway"
    
      120  npm install \
    
      121    --ignore-scripts \
    
      122    --no-audit \
    
      123    --no-fund \
    
      124    --omit=dev \
    
      125    "better-sqlite3@12.9.0" \
    
      126    "@node-rs/xxhash@1.7.6" \
    
      127    "sharp@0.34.5" \
    
      128    "undici@8.5.0" \
    
      129    "ws@8.21.0"
    
      130
    
      131  export npm_config_runtime=electron
    
      132  export npm_config_target="${_electron_major}.0.0"
    
      133  export npm_config_disturl='https://electronjs.org/headers'
    
      134  export npm_config_build_from_source=true
    
      135
    
      136  npx --yes @electron/rebuild -v "${_electron_major}.0.0" --force \
    
      137    -m "${srcdir}/resources/gateway"
    
      138
    
      139  find "${srcdir}/resources/gateway/node_modules" \
    
      140    \( -path '*/.prepack-darwin-*' -o -path '*/bin/darwin-*' -o -path '*/@img/sharp-darwin-*' -o -path '*/@img/sharp-libvips-darwin-*' -o -path '*/@node-rs/xxhash-darwin-*' \) \
    
      141    -prune -exec rm -rf '{}' +
    
      142
    
      143  find "${srcdir}/resources/gateway/node_modules" \
    
      144    -type f \( -name Makefile -o -name '*.mk' -o -name config.gypi \) \
    
      145    -delete
    
      146  find "${srcdir}/resources/gateway/node_modules" \
    
      147    -type d -name .deps -prune -exec rm -rf '{}' +
    
      148}
    
      149
    
      150package() {
    
      151  cd "${srcdir}"
    
      152
    
      153  install -dm755 \
    
      154    "${pkgdir}/usr/bin" \
    
      155    "${pkgdir}/usr/lib/${pkgname}/resources" \
    
      156    "${pkgdir}/usr/share/applications" \
    
      157    "${pkgdir}/usr/share/doc/${pkgname}" \
    
      158    "${pkgdir}/usr/share/icons/hicolor/512x512/apps" \
    
      159    "${pkgdir}/usr/share/licenses/${pkgname}"
    
      160
    
      161  install -Dm755 "${srcdir}/minimax-hub.sh" \
    
      162    "${pkgdir}/usr/bin/minimax-hub"
    
      163  install -Dm644 "${srcdir}/minimax-hub.desktop" \
    
      164    "${pkgdir}/usr/share/applications/minimax-hub.desktop"
    
      165
    
      166  install -Dm644 app.asar \
    
      167    "${pkgdir}/usr/lib/${pkgname}/resources/app.asar"
    
      168  cp -a resources/. \
    
      169    "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      170  find "${pkgdir}/usr/lib/${pkgname}/resources" -type d -exec chmod 755 '{}' +
    
      171  find "${pkgdir}/usr/lib/${pkgname}/resources" -type f -perm /111 -exec chmod 755 '{}' +
    
      172  find "${pkgdir}/usr/lib/${pkgname}/resources" -type f ! -perm /111 -exec chmod 644 '{}' +
    
      173
    
      174  install -Dm644 resources/app-resources/icon.png \
    
      175    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/minimax-hub.png"
    
      176  install -Dm644 app-extracted/package.json \
    
      177    "${pkgdir}/usr/share/doc/${pkgname}/package.json"
    
      178  install -Dm644 "${srcdir}/LICENSE" \
    
      179    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      180}
    
      181

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 
 pkgname=minimax-hub-bin
 _pkgname=minimax-hub
-pkgver=2.0.4
+pkgver=2.0.8
 pkgrel=6
 pkgdesc='MiniMax Hub desktop app repackaged from the official macOS release'
 arch=('x86_64' 'aarch64')
@@ -38,10 +38,10 @@
   'LICENSE'
 )
 source_x86_64=(
-  "MiniMax-Hub-${pkgver}-mac-x64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.4/hilo-desktop-757/MiniMax%20Hub-2.0.4-mac.zip"
+  "MiniMax-Hub-${pkgver}-mac-x64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.8/hilo-desktop-779/MiniMax%20Hub-2.0.8-mac.zip"
 )
 source_aarch64=(
-  "MiniMax-Hub-${pkgver}-mac-arm64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.4/hilo-desktop-757/MiniMax%20Hub-2.0.4-arm64-mac.zip"
+  "MiniMax-Hub-${pkgver}-mac-arm64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.8/hilo-desktop-779/MiniMax%20Hub-2.0.8-arm64-mac.zip"
 )
 noextract=(
   "MiniMax-Hub-${pkgver}-mac-x64.zip"
@@ -52,8 +52,8 @@
             '9d78784df2f0854fdf08d436c22501adff17068de77ae584254045e51c041490'
             '20bcf5b029a2b88bd1027207f287e44d87586d2dac6e82ac66174141f9fb928b'
             'a95f4a1bb7d5ba464ca8503549fa98a6d6bdfc667af0a9265f6b01416f85de96')
-sha256sums_x86_64=('aac7852006464a371b163a7778877d5cf788739d34c82a03d894d86e159727ea')
-sha256sums_aarch64=('0e877b3298551e42f281aee819815034113fc0ec542bbcf130e29218fa4423ab')
+sha256sums_x86_64=('992d7b6944cc76041ddfb3841e1a087b55fdc1b51c69f0ad92c0340429d98f2e')
+sha256sums_aarch64=('48a3d1a5476cf92e4df6475602ea5c3abb6cffc58ed0cb572f7d8ffad7a46c90')
 
 _electron_major=39
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 05:20:08	MEDIUM	2
2026-08-01 00:11:18	LOW	3
2026-07-31 03:17:12	MEDIUM	2
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 05:10:22	MEDIUM	2
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 05:29:17	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 05:27:22	MEDIUM	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3