mockitt-cn

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:27 source_x86_64=("${pkgname}-${pkgver}.deb::https://cdn-release.modao.cc/desktop/prod-${pkgver}/linux/modao-linux-x64-${pkgver}.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from cdn-release.modao.cc, which is the official CDN for the Modao/Mockitt desktop application (a legitimate Chinese prototyping tool). The URL pattern and domain are consistent with the vendor's official distribution infrastructure. However, this is still a prebuilt proprietary binary from a vendor CDN rather than source-built, and the host is not a well-known, independently verifiable platform. The sha256sum is pinned, which mitigates substitution risk at the specific version. The package extracts and installs the binary directly. This is a standard pattern for AUR packages wrapping proprietary software distributed as .deb files, but the non-standard CDN host means users must trust that cdn-release.modao.cc has not been compromised or that the maintainer's checksum is correct. Overall this is a legitimate medium-risk pattern (prebuilt binary from vendor CDN) rather than a clear attack, consistent with many AUR proprietary software packages.