monitask

maintainer sergeyanisimov · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary tarball from an Azure Blob Storage URL (deskcap.blob.core.windows.net) controlled by the vendor/maintainer rather than a canonical, verifiable upstream release page. The binary 'Monitask' is installed and made executable directly from this tarball. While Azure Blob Storage is a legitimate hosting service and the domain appears to belong to the Monitask product (consistent with the official URL monitask.com), the artifact is not signed, the md5sum is weak (MD5 is cryptographically broken), and there is no way to independently verify the binary's integrity or provenance beyond the checksum. This is a real supply-chain concern: if the blob storage bucket were compromised or the URL silently updated, users would execute arbitrary code. The pattern is common for proprietary closed-source AUR packages but still warrants medium severity due to the executed binary from a non-canonical host with only MD5 verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://deskcap.blob.core.windows.net/deployment/Linux/arch/prod/${pkgname}-${pkgver}-${pkgrel}.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary tarball from an Azure Blob Storage URL (deskcap.blob.core.windows.net) controlled by the vendor/maintainer rather than a canonical, verifiable upstream release page. The binary 'Monitask' is installed and made executable directly from this tarball. While Azure Blob Storage is a legitimate hosting service and the domain appears to belong to the Monitask product (consistent with the official URL monitask.com), the artifact is not signed, the md5sum is weak (MD5 is cryptographically broken), and there is no way to independently verify the binary's integrity or provenance beyond the checksum. This is a real supply-chain concern: if the blob storage bucket were compromised or the URL silently updated, users would execute arbitrary code. The pattern is common for proprietary closed-source AUR packages but still warrants medium severity due to the executed binary from a non-canonical host with only MD5 verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ruslan Askarov <ruslan@festagency.com>
    
      2# Maintainer: Sergey Anisimov <sergey@festagency.com>
    
      3pkgname=monitask
    
      4pkgver=1.0
    
      5pkgrel=32
    
      6pkgdesc="Monitask desktop linux time tracker"
    
      7arch=("x86_64")
    
      8url="https://www.monitask.com/Home/Download"
    
      9install=
    
      10license=('unknown')
    
      11source=("https://deskcap.blob.core.windows.net/deployment/Linux/arch/prod/${pkgname}-${pkgver}-${pkgrel}.tar.gz")
    
      12options=('staticlibs')
    
      13depends=('libxss' 'xterm' 'libxfixes')
    
      14md5sums=('4d6f56da945c5a89ee1b545871c8022b')
    
      15
    
      16package () {
    
      17  mkdir -p "${pkgdir}/opt/monitask"
    
      18  mkdir -p "${pkgdir}/usr/share/applications"
    
      19  mkdir -p "${pkgdir}/usr/share/pixmaps"
    
      20  mkdir -p "${pkgdir}/usr/bin"
    
      21  install -Dm644 "${srcdir}/files/$pkgname.desktop" "${pkgdir}/usr/share/applications/$pkgname.desktop"
    
      22  install -Dm644 "${srcdir}/files/mt_znak.svg" "${pkgdir}/usr/share/pixmaps/$pkgname.svg"
    
      23  install -Dm644 "${srcdir}/files/monitask.sh" "${pkgdir}/usr/bin/$pkgname.sh"
    
      24
    
      25  cp -ar ${srcdir}/${pkgname}-${pkgver}-${pkgrel}/* "${pkgdir}/opt/monitask/"
    
      26  chmod +x "${pkgdir}/opt/monitask/Monitask"
    
      27  chmod +x "${pkgdir}/usr/bin/$pkgname.sh"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2