napcat-qq

LOW

maintainer orphaned 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from Tencent's official domain (qqdl.gtimg.cn) for legitimate QQ binaries and builds a small injector from source; the host is not whitelisted but is plausibly official and non-swappable, with no code execution from untrusted sources.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Tencent's official domain (qqdl.gtimg.cn) for legitimate QQ binaries and builds a small injector from source; the host is not whitelisted but is plausibly official and non-swappable, with no code execution from untrusted sources.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source_x86_64=("linuxqq_${_qqver}_amd64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yuzuki <lxf74663@gmail.com>
    
      2pkgname=napcat-qq
    
      3pkgver=4.18.38
    
      4pkgrel=1
    
      5pkgdesc="现代化的基于 NTQQ 的 Bot 协议端实现"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/NapNeko/NapCatQQ"
    
      8license=('custom')
    
      9depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'xorg-server-xvfb' 'screen')
    
      10makedepends=('unzip' 'clang')
    
      11install='napcat-qq.install'
    
      12_qqver="3.2.34-53644"
    
      13
    
      14source=("NapCat.Shell-${pkgver}.zip::https://github.com/NapNeko/NapCatQQ/releases/download/v${pkgver}/NapCat.Shell.zip"
    
      15        "napcat-qq.sh"
    
      16        "napcat-qq.install"
    
      17        "launcher.cpp")
    
      18
    
      19sha256sums=('735f2e633247df3ffd6e8ee8b84d7039c315b2655f5807e5f0029f93d2c30016'
    
      20            '80f20352148b3c66c22cdc3a6ba06138ceeef0031abf57903d7312ef7e4839a9'
    
      21            'fecf169a5e052b9b475d9c28594f5f57557c4424391bf1e6190e2d1a33eeb8e2'
    
      22            '601b88813a8563dcd71c7961fc34a9b352226671e31aa603faa9f0f4fe54995a')
    
      23sha256sums_x86_64=('436c65e1dd28422e128a21cbddb5fe4e2e6c079d7f27fec2541e014d38cc336e')
    
      24sha256sums_aarch64=('181b895cb573548e396e54bb0548cca92ffdc1b1a4b018fa4551bb062385fdca')
    
      25
    
      26source_x86_64=("linuxqq_${_qqver}_amd64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_amd64.deb")
    
      27source_aarch64=("linuxqq_${_qqver}_arm64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_arm64.deb")
    
      28
    
      29build() {
    
      30    cd "${srcdir}"
    
      31    echo "编译 launcher 动态注入库..."
    
      32
    
      33    clang++ -shared -fPIC \
    
      34        -Os \
    
      35        -flto \
    
      36        -march=native \
    
      37        -fno-exceptions \
    
      38        -fno-rtti \
    
      39        -fvisibility=hidden \
    
      40        -Wl,--exclude-libs,ALL \
    
      41        launcher.cpp -o libnapcat_launcher.so -ldl
    
      42}
    
      43
    
      44package() {
    
      45    install -d "${pkgdir}/opt/napcat-qq"
    
      46
    
      47    if [ "$CARCH" = "x86_64" ]; then
    
      48        bsdtar -xf "linuxqq_${_qqver}_amd64.deb" -C "${srcdir}" 2>/dev/null || true
    
      49    elif [ "$CARCH" = "aarch64" ]; then
    
      50        bsdtar -xf "linuxqq_${_qqver}_arm64.deb" -C "${srcdir}" 2>/dev/null || true
    
      51    fi
    
      52
    
      53    bsdtar -xf "${srcdir}/data.tar.xz" -C "${srcdir}"
    
      54    cp -r "${srcdir}/opt/QQ/"* "${pkgdir}/opt/napcat-qq/"
    
      55
    
      56    # 解压 NapCat 核心文件
    
      57    _appdir="${pkgdir}/opt/napcat-qq/resources/app"
    
      58    install -d "${_appdir}/app_launcher/napcat-base"
    
      59    unzip -q -o "${srcdir}/NapCat.Shell-${pkgver}.zip" -d "${_appdir}/app_launcher/napcat-base/"
    
      60
    
      61    _napcat_mjs="${_appdir}/app_launcher/napcat-base/napcat.mjs"
    
      62
    
      63    # 注入 return null 取消屏蔽第三方插件
    
      64    if [ -f "$_napcat_mjs" ]; then
    
      65        sed -i -E 's/(getRejectReason\([a-zA-Z0-9, ]*\) *\{)/\1 return null;/g' "$_napcat_mjs"
    
      66    fi
    
      67
    
      68    # 清理多余平台文件
    
      69    rm -f "${_appdir}/app_launcher/napcat-base/"*.bat \
    
      70          "${_appdir}/app_launcher/napcat-base/"*.exe \
    
      71          "${_appdir}/app_launcher/napcat-base/"*.dll \
    
      72          "${_appdir}/app_launcher/napcat-base/loadNapCat.js"
    
      73
    
      74    _nativedir="${_appdir}/app_launcher/napcat-base/native"
    
      75    if [ -d "$_nativedir" ]; then
    
      76        find "$_nativedir" -name "*win32*" -exec rm -rf {} + 2>/dev/null || true
    
      77        find "$_nativedir" -name "*darwin*" -exec rm -rf {} + 2>/dev/null || true
    
      78        rm -rf "$_nativedir/dpapi"
    
      79
    
      80        if [ "$CARCH" = "x86_64" ]; then
    
      81            find "$_nativedir" -name "*arm64*" -exec rm -rf {} + 2>/dev/null || true
    
      82        elif [ "$CARCH" = "aarch64" ]; then
    
      83            find "$_nativedir" -name "*x64*" -exec rm -rf {} + 2>/dev/null || true
    
      84        fi
    
      85    fi
    
      86
    
      87    cat > "${_appdir}/loadNapCat.js" << 'EOF'
    
      88(async () => {
    
      89    const os = require('os');
    
      90    const path = require('path');
    
      91    const target = path.join(os.homedir(), '.config', 'napcat-qq-plugin', 'napcat.mjs');
    
      92    await import('file://' + target);
    
      93})();
    
      94EOF
    
      95
    
      96    install -Dm755 "${srcdir}/libnapcat_launcher.so" "${pkgdir}/opt/napcat-qq/libnapcat_launcher.so"
    
      97
    
      98    # 安装启动脚本
    
      99    install -Dm755 "${srcdir}/napcat-qq.sh" "${pkgdir}/usr/bin/napcat-qq"
    
      100}
    
      101

Changes since previous scan

--- PKGBUILD @ 2026-10-15 00:28
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,6 +1,6 @@
 # Maintainer: Yuzuki <lxf74663@gmail.com>
 pkgname=napcat-qq
-pkgver=4.18.19
+pkgver=4.18.38
 pkgrel=1
 pkgdesc="现代化的基于 NTQQ 的 Bot 协议端实现"
 arch=('x86_64' 'aarch64')
@@ -9,22 +9,22 @@
 depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'xorg-server-xvfb' 'screen')
 makedepends=('unzip' 'clang')
 install='napcat-qq.install'
-_qqver="3.2.30-50969"
+_qqver="3.2.34-53644"
 
 source=("NapCat.Shell-${pkgver}.zip::https://github.com/NapNeko/NapCatQQ/releases/download/v${pkgver}/NapCat.Shell.zip"
         "napcat-qq.sh"
         "napcat-qq.install"
         "launcher.cpp")
 
-sha256sums=('c5b7423d1d5b8c555d62cd9e4059b1908cc0986e7b5c85a0f450f4a8ed170acf'
-            '2a60a09b349558bff7e638f7b5c6b0563b62457293b2d9a3d8cb63bb84a932b7'
+sha256sums=('735f2e633247df3ffd6e8ee8b84d7039c315b2655f5807e5f0029f93d2c30016'
+            '80f20352148b3c66c22cdc3a6ba06138ceeef0031abf57903d7312ef7e4839a9'
             'fecf169a5e052b9b475d9c28594f5f57557c4424391bf1e6190e2d1a33eeb8e2'
             '601b88813a8563dcd71c7961fc34a9b352226671e31aa603faa9f0f4fe54995a')
-sha256sums_x86_64=('98f0d8cfd0d689e898c36432feada8ada2df9d287dda52a3389cc795978c0c0e')
-sha256sums_aarch64=('68d59a60f8bb67b84fffe21cb67d4f1e54628b8383c8eb296e3c632ec43dc392')
+sha256sums_x86_64=('436c65e1dd28422e128a21cbddb5fe4e2e6c079d7f27fec2541e014d38cc336e')
+sha256sums_aarch64=('181b895cb573548e396e54bb0548cca92ffdc1b1a4b018fa4551bb062385fdca')
 
-source_x86_64=("linuxqq_${_qqver}_amd64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.32/beta/fd40a3ec/linuxqq_3.2.30-50969_amd64.deb")
-source_aarch64=("linuxqq_${_qqver}_arm64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.32/beta/fd40a3ec/linuxqq_3.2.30-50969_arm64.deb")
+source_x86_64=("linuxqq_${_qqver}_amd64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_amd64.deb")
+source_aarch64=("linuxqq_${_qqver}_arm64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/9ee04bef/linuxqq_3.2.34-53644_arm64.deb")
 
 build() {
     cd "${srcdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 11:11:38	Medium	1
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2