napcat-qq

LOW

maintainer Yueyuri 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from Tencent's official domain (qqdl.gtimg.cn) for legitimate QQ binaries and builds a small injector library from source; the host is not whitelisted but is plausibly official and non-swappable, and no untrusted executable code is remotely fetched or executed.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Tencent's official domain (qqdl.gtimg.cn) for legitimate QQ binaries and builds a small injector library from source; the host is not whitelisted but is plausibly official and non-swappable, and no untrusted executable code is remotely fetched or executed.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source_x86_64=("linuxqq_${_qqver}_amd64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.32/beta/fd40a3ec/linuxqq_3.2.30-50969_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yuzuki <lxf74663@gmail.com>
    
      2pkgname=napcat-qq
    
      3pkgver=4.18.19
    
      4pkgrel=1
    
      5pkgdesc="现代化的基于 NTQQ 的 Bot 协议端实现"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/NapNeko/NapCatQQ"
    
      8license=('custom')
    
      9depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'xorg-server-xvfb' 'screen')
    
      10makedepends=('unzip' 'clang')
    
      11install='napcat-qq.install'
    
      12_qqver="3.2.30-50969"
    
      13
    
      14source=("NapCat.Shell-${pkgver}.zip::https://github.com/NapNeko/NapCatQQ/releases/download/v${pkgver}/NapCat.Shell.zip"
    
      15        "napcat-qq.sh"
    
      16        "napcat-qq.install"
    
      17        "launcher.cpp")
    
      18
    
      19sha256sums=('c5b7423d1d5b8c555d62cd9e4059b1908cc0986e7b5c85a0f450f4a8ed170acf'
    
      20            '2a60a09b349558bff7e638f7b5c6b0563b62457293b2d9a3d8cb63bb84a932b7'
    
      21            'fecf169a5e052b9b475d9c28594f5f57557c4424391bf1e6190e2d1a33eeb8e2'
    
      22            '601b88813a8563dcd71c7961fc34a9b352226671e31aa603faa9f0f4fe54995a')
    
      23sha256sums_x86_64=('98f0d8cfd0d689e898c36432feada8ada2df9d287dda52a3389cc795978c0c0e')
    
      24sha256sums_aarch64=('68d59a60f8bb67b84fffe21cb67d4f1e54628b8383c8eb296e3c632ec43dc392')
    
      25
    
      26source_x86_64=("linuxqq_${_qqver}_amd64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.32/beta/fd40a3ec/linuxqq_3.2.30-50969_amd64.deb")
    
      27source_aarch64=("linuxqq_${_qqver}_arm64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.32/beta/fd40a3ec/linuxqq_3.2.30-50969_arm64.deb")
    
      28
    
      29build() {
    
      30    cd "${srcdir}"
    
      31    echo "编译 launcher 动态注入库..."
    
      32
    
      33    clang++ -shared -fPIC \
    
      34        -Os \
    
      35        -flto \
    
      36        -march=native \
    
      37        -fno-exceptions \
    
      38        -fno-rtti \
    
      39        -fvisibility=hidden \
    
      40        -Wl,--exclude-libs,ALL \
    
      41        launcher.cpp -o libnapcat_launcher.so -ldl
    
      42}
    
      43
    
      44package() {
    
      45    install -d "${pkgdir}/opt/napcat-qq"
    
      46
    
      47    if [ "$CARCH" = "x86_64" ]; then
    
      48        bsdtar -xf "linuxqq_${_qqver}_amd64.deb" -C "${srcdir}" 2>/dev/null || true
    
      49    elif [ "$CARCH" = "aarch64" ]; then
    
      50        bsdtar -xf "linuxqq_${_qqver}_arm64.deb" -C "${srcdir}" 2>/dev/null || true
    
      51    fi
    
      52
    
      53    bsdtar -xf "${srcdir}/data.tar.xz" -C "${srcdir}"
    
      54    cp -r "${srcdir}/opt/QQ/"* "${pkgdir}/opt/napcat-qq/"
    
      55
    
      56    # 解压 NapCat 核心文件
    
      57    _appdir="${pkgdir}/opt/napcat-qq/resources/app"
    
      58    install -d "${_appdir}/app_launcher/napcat-base"
    
      59    unzip -q -o "${srcdir}/NapCat.Shell-${pkgver}.zip" -d "${_appdir}/app_launcher/napcat-base/"
    
      60
    
      61    _napcat_mjs="${_appdir}/app_launcher/napcat-base/napcat.mjs"
    
      62
    
      63    # 注入 return null 取消屏蔽第三方插件
    
      64    if [ -f "$_napcat_mjs" ]; then
    
      65        sed -i -E 's/(getRejectReason\([a-zA-Z0-9, ]*\) *\{)/\1 return null;/g' "$_napcat_mjs"
    
      66    fi
    
      67
    
      68    # 清理多余平台文件
    
      69    rm -f "${_appdir}/app_launcher/napcat-base/"*.bat \
    
      70          "${_appdir}/app_launcher/napcat-base/"*.exe \
    
      71          "${_appdir}/app_launcher/napcat-base/"*.dll \
    
      72          "${_appdir}/app_launcher/napcat-base/loadNapCat.js"
    
      73
    
      74    _nativedir="${_appdir}/app_launcher/napcat-base/native"
    
      75    if [ -d "$_nativedir" ]; then
    
      76        find "$_nativedir" -name "*win32*" -exec rm -rf {} + 2>/dev/null || true
    
      77        find "$_nativedir" -name "*darwin*" -exec rm -rf {} + 2>/dev/null || true
    
      78        rm -rf "$_nativedir/dpapi"
    
      79
    
      80        if [ "$CARCH" = "x86_64" ]; then
    
      81            find "$_nativedir" -name "*arm64*" -exec rm -rf {} + 2>/dev/null || true
    
      82        elif [ "$CARCH" = "aarch64" ]; then
    
      83            find "$_nativedir" -name "*x64*" -exec rm -rf {} + 2>/dev/null || true
    
      84        fi
    
      85    fi
    
      86
    
      87    cat > "${_appdir}/loadNapCat.js" << 'EOF'
    
      88(async () => {
    
      89    const os = require('os');
    
      90    const path = require('path');
    
      91    const target = path.join(os.homedir(), '.config', 'napcat-qq-plugin', 'napcat.mjs');
    
      92    await import('file://' + target);
    
      93})();
    
      94EOF
    
      95
    
      96    install -Dm755 "${srcdir}/libnapcat_launcher.so" "${pkgdir}/opt/napcat-qq/libnapcat_launcher.so"
    
      97
    
      98    # 安装启动脚本
    
      99    install -Dm755 "${srcdir}/napcat-qq.sh" "${pkgdir}/usr/bin/napcat-qq"
    
      100}
    
      101

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2