minimax-hub-bin
LOW
maintainer duanluan
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package repackages an official macOS release from the vendor's own domain, patches it for Linux, and uses npx/rebuild for native module compilation against Electron; the non-whitelisted host is the vendor's CDN and the remote execution is part of a standard build toolchain for Electron apps.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package repackages an official macOS release from the vendor's own domain, patches it for Linux, and uses npx/rebuild for native module compilation against Electron; the non-whitelisted host is the vendor's CDN and the remote execution is part of a standard build toolchain for Electron apps.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:136
npx --yes @electron/rebuild -v "${_electron_major}.0.0" --force \
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:41
"MiniMax-Hub-${pkgver}-mac-x64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.15/hilo-desktop-870/MiniMax%20Design-2.0.15-mac.zip"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: duanluan <duanluan@outlook.com>
2
3
pkgname=minimax-hub-bin
4
_pkgname=minimax-hub
5
pkgver=2.0.15
6
pkgrel=6
7
pkgdesc='MiniMax Hub desktop app repackaged from the official macOS release'
8
arch=('x86_64' 'aarch64')
9
url='https://hub.minimaxi.com/'
10
license=('custom:proprietary')
11
depends=(
12
'electron39'
13
'ffmpeg'
14
'hicolor-icon-theme'
15
'nodejs'
16
'xdg-utils'
17
)
18
optdepends=(
19
'opencode: OpenCode runtime from the Arch repositories'
20
'npm: install opencode-ai globally as an alternative OpenCode runtime'
21
)
22
makedepends=(
23
'7zip'
24
'asar'
25
'nodejs'
26
'npm'
27
'python'
28
)
29
provides=('minimax-hub')
30
conflicts=('minimax-hub')
31
options=('!strip' '!lto')
32
install='minimax-hub-bin.install'
33
source=(
34
'minimax-hub.sh'
35
'minimax-hub.desktop'
36
'patch-linux-runtime.mjs'
37
'minimax-hub-bin.install'
38
'LICENSE'
39
)
40
source_x86_64=(
41
"MiniMax-Hub-${pkgver}-mac-x64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.15/hilo-desktop-870/MiniMax%20Design-2.0.15-mac.zip"
42
)
43
source_aarch64=(
44
"MiniMax-Hub-${pkgver}-mac-arm64.zip::https://filecdn.minimax.chat/public/minimax-hub/release/domestic/builds/2.0.15/hilo-desktop-870/MiniMax%20Design-2.0.15-arm64-mac.zip"
45
)
46
noextract=(
47
"MiniMax-Hub-${pkgver}-mac-x64.zip"
48
"MiniMax-Hub-${pkgver}-mac-arm64.zip"
49
)
50
sha256sums=('4e8ac22b373c6290dbd80576df9d9bec4203d1aafc4fbbbdb33e556966de5e04'
51
'4c9da9d8bab463dbd04b4320c1a2f2b4dfc885e2e4a1a53955fb328e1a271329'
52
'9d78784df2f0854fdf08d436c22501adff17068de77ae584254045e51c041490'
53
'20bcf5b029a2b88bd1027207f287e44d87586d2dac6e82ac66174141f9fb928b'
54
'a95f4a1bb7d5ba464ca8503549fa98a6d6bdfc667af0a9265f6b01416f85de96')
55
sha256sums_x86_64=('c3b2487920da71ee6e5242077d0fa79012f990f69a9325f57d1e285bac153a11')
56
sha256sums_aarch64=('64e4cdaa0f094ffb59cb913ff4af026874df3fb9d78ce9015a91882d9fe26538')
57
58
_electron_major=39
59
60
prepare() {
61
cd "${srcdir}"
62
rm -rf upstream-app app-extracted app.asar resources native-build
63
mkdir upstream-app resources
64
65
local archive_file appdir
66
case "${CARCH}" in
67
x86_64)
68
archive_file="MiniMax-Hub-${pkgver}-mac-x64.zip"
69
;;
70
aarch64)
71
archive_file="MiniMax-Hub-${pkgver}-mac-arm64.zip"
72
;;
73
*)
74
echo "Unsupported architecture: ${CARCH}" >&2
75
return 1
76
;;
77
esac
78
79
7z x -bd -y "${archive_file}" -oupstream-app >/dev/null
80
81
appdir="$(find upstream-app -path '*/MiniMax Hub.app' -type d -print -quit)"
82
83
[[ -n "${appdir}" && -d "${appdir}" ]] || {
84
echo "Could not find MiniMax Hub.app in upstream archive" >&2
85
return 1
86
}
87
88
local upstream_resources="${appdir}/Contents/Resources"
89
90
asar extract "${upstream_resources}/app.asar" app-extracted
91
node "${srcdir}/patch-linux-runtime.mjs" app-extracted
92
asar pack app-extracted app.asar
93
94
cp -a \
95
"${upstream_resources}/app-resources" \
96
"${upstream_resources}/conf" \
97
"${upstream_resources}/gateway" \
98
"${upstream_resources}/mcp-tools" \
99
"${upstream_resources}/opencode" \
100
"${upstream_resources}/opencode-plugin-hilo" \
101
"${upstream_resources}/opencode-plugin-trace" \
102
resources/
103
104
install -Dm644 "${upstream_resources}/app-update.yml" \
105
resources/app-update.yml
106
107
rm -rf resources/ffmpeg
108
install -dm755 resources/ffmpeg
109
ln -s /usr/bin/ffmpeg resources/ffmpeg/ffmpeg
110
ln -s /usr/bin/ffprobe resources/ffmpeg/ffprobe
111
112
rm -f resources/opencode/opencode
113
ln -s /usr/bin/opencode resources/opencode/opencode
114
115
find resources \
116
\( -name '.DS_Store' -o -name '._*' -o -name '*:com.apple.*' \) \
117
-delete
118
119
cd "${srcdir}/resources/gateway"
120
npm install \
121
--ignore-scripts \
122
--no-audit \
123
--no-fund \
124
--omit=dev \
125
"better-sqlite3@12.9.0" \
126
"@node-rs/xxhash@1.7.6" \
127
"sharp@0.34.5" \
128
"undici@8.5.0" \
129
"ws@8.21.0"
130
131
export npm_config_runtime=electron
132
export npm_config_target="${_electron_major}.0.0"
133
export npm_config_disturl='https://electronjs.org/headers'
134
export npm_config_build_from_source=true
135
136
npx --yes @electron/rebuild -v "${_electron_major}.0.0" --force \
137
-m "${srcdir}/resources/gateway"
138
139
find "${srcdir}/resources/gateway/node_modules" \
140
\( -path '*/.prepack-darwin-*' -o -path '*/bin/darwin-*' -o -path '*/@img/sharp-darwin-*' -o -path '*/@img/sharp-libvips-darwin-*' -o -path '*/@node-rs/xxhash-darwin-*' \) \
141
-prune -exec rm -rf '{}' +
142
143
find "${srcdir}/resources/gateway/node_modules" \
144
-type f \( -name Makefile -o -name '*.mk' -o -name config.gypi \) \
145
-delete
146
find "${srcdir}/resources/gateway/node_modules" \
147
-type d -name .deps -prune -exec rm -rf '{}' +
148
}
149
150
package() {
151
cd "${srcdir}"
152
153
install -dm755 \
154
"${pkgdir}/usr/bin" \
155
"${pkgdir}/usr/lib/${pkgname}/resources" \
156
"${pkgdir}/usr/share/applications" \
157
"${pkgdir}/usr/share/doc/${pkgname}" \
158
"${pkgdir}/usr/share/icons/hicolor/512x512/apps" \
159
"${pkgdir}/usr/share/licenses/${pkgname}"
160
161
install -Dm755 "${srcdir}/minimax-hub.sh" \
162
"${pkgdir}/usr/bin/minimax-hub"
163
install -Dm644 "${srcdir}/minimax-hub.desktop" \
164
"${pkgdir}/usr/share/applications/minimax-hub.desktop"
165
166
install -Dm644 app.asar \
167
"${pkgdir}/usr/lib/${pkgname}/resources/app.asar"
168
cp -a resources/. \
169
"${pkgdir}/usr/lib/${pkgname}/resources/"
170
find "${pkgdir}/usr/lib/${pkgname}/resources" -type d -exec chmod 755 '{}' +
171
find "${pkgdir}/usr/lib/${pkgname}/resources" -type f -perm /111 -exec chmod 755 '{}' +
172
find "${pkgdir}/usr/lib/${pkgname}/resources" -type f ! -perm /111 -exec chmod 644 '{}' +
173
174
install -Dm644 resources/app-resources/icon.png \
175
"${pkgdir}/usr/share/icons/hicolor/512x512/apps/minimax-hub.png"
176
install -Dm644 app-extracted/package.json \
177
"${pkgdir}/usr/share/doc/${pkgname}/package.json"
178
install -Dm644 "${srcdir}/LICENSE" \
179
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
180
}
181
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 00:19:57 | Low | 3 |
| 2026-08-30 00:04:14 | Low | 3 |
| 2026-08-29 00:29:17 | Low | 3 |