napcat-qq

maintainer Yueyuri · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from Tencent's official domain (qqdl.gtimg.cn) for legitimate QQ binaries and builds a small injector from source; the main payload is data/resources for a bot frontend, not executed code, and the non-whitelisted host is Tencent's own release infrastructure, posing low risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Tencent's official domain (qqdl.gtimg.cn) for legitimate QQ binaries and builds a small injector from source; the main payload is data/resources for a bot frontend, not executed code, and the non-whitelisted host is Tencent's own release infrastructure, posing low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source_x86_64=("linuxqq_${_qqver}_amd64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.31/beta/00e6a3e7/linuxqq_3.2.29-49738_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yuzuki <lxf74663@gmail.com>
    
      2pkgname=napcat-qq
    
      3pkgver=4.18.13
    
      4pkgrel=1
    
      5pkgdesc="现代化的基于 NTQQ 的 Bot 协议端实现"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/NapNeko/NapCatQQ"
    
      8license=('custom')
    
      9depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'xorg-server-xvfb' 'screen')
    
      10makedepends=('unzip' 'clang')
    
      11install='napcat-qq.install'
    
      12_qqver="3.2.29-49738"
    
      13
    
      14source=("NapCat.Shell-${pkgver}.zip::https://github.com/NapNeko/NapCatQQ/releases/download/v${pkgver}/NapCat.Shell.zip"
    
      15        "napcat-qq.sh"
    
      16        "napcat-qq.install"
    
      17        "launcher.cpp")
    
      18
    
      19sha256sums=('85bb5b889caa61a5e671bf1b07ddb27d8b0a69f5a68016a3480aeff2ae220d03'
    
      20            'aeead48bc5d3e00ae7fd67d1b31b98d79ec5283210d21a69b3521537cbcea39c'
    
      21            'fecf169a5e052b9b475d9c28594f5f57557c4424391bf1e6190e2d1a33eeb8e2'
    
      22            '601b88813a8563dcd71c7961fc34a9b352226671e31aa603faa9f0f4fe54995a')
    
      23sha256sums_x86_64=('1e3828079673c94994bc0f4780d5d8528647639920659862d49d1c2f2a198e25')
    
      24sha256sums_aarch64=('5bcd8ccda401fbfa1821a7c3c758f84a253c317568f0b9c2d74426a24749e9a6')
    
      25
    
      26source_x86_64=("linuxqq_${_qqver}_amd64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.31/beta/00e6a3e7/linuxqq_3.2.29-49738_amd64.deb")
    
      27source_aarch64=("linuxqq_${_qqver}_arm64.deb::https://qqdl.gtimg.cn/qqfile/QQNT/9.9.31/beta/00e6a3e7/linuxqq_3.2.29-49738_arm64.deb")
    
      28
    
      29build() {
    
      30    cd "${srcdir}"
    
      31    echo "编译 launcher 动态注入库..."
    
      32
    
      33    clang++ -shared -fPIC \
    
      34        -Os \
    
      35        -flto \
    
      36        -march=native \
    
      37        -fno-exceptions \
    
      38        -fno-rtti \
    
      39        -fvisibility=hidden \
    
      40        -Wl,--exclude-libs,ALL \
    
      41        launcher.cpp -o libnapcat_launcher.so -ldl
    
      42}
    
      43
    
      44package() {
    
      45    install -d "${pkgdir}/opt/napcat-qq"
    
      46
    
      47    if [ "$CARCH" = "x86_64" ]; then
    
      48        bsdtar -xf "linuxqq_${_qqver}_amd64.deb" -C "${srcdir}" 2>/dev/null || true
    
      49    elif [ "$CARCH" = "aarch64" ]; then
    
      50        bsdtar -xf "linuxqq_${_qqver}_arm64.deb" -C "${srcdir}" 2>/dev/null || true
    
      51    fi
    
      52
    
      53    bsdtar -xf "${srcdir}/data.tar.xz" -C "${srcdir}"
    
      54    cp -r "${srcdir}/opt/QQ/"* "${pkgdir}/opt/napcat-qq/"
    
      55
    
      56    # 解压 NapCat 核心文件
    
      57    _appdir="${pkgdir}/opt/napcat-qq/resources/app"
    
      58    install -d "${_appdir}/app_launcher/napcat-base"
    
      59    unzip -q -o "${srcdir}/NapCat.Shell-${pkgver}.zip" -d "${_appdir}/app_launcher/napcat-base/"
    
      60
    
      61    _napcat_mjs="${_appdir}/app_launcher/napcat-base/napcat.mjs"
    
      62
    
      63    # 注入 return null 取消屏蔽第三方插件
    
      64    if [ -f "$_napcat_mjs" ]; then
    
      65        sed -i -E 's/(getRejectReason\([a-zA-Z0-9, ]*\) *\{)/\1 return null;/g' "$_napcat_mjs"
    
      66    fi
    
      67
    
      68    # 清理多余平台文件
    
      69    rm -f "${_appdir}/app_launcher/napcat-base/"*.bat \
    
      70          "${_appdir}/app_launcher/napcat-base/"*.exe \
    
      71          "${_appdir}/app_launcher/napcat-base/"*.dll \
    
      72          "${_appdir}/app_launcher/napcat-base/loadNapCat.js"
    
      73
    
      74    _nativedir="${_appdir}/app_launcher/napcat-base/native"
    
      75    if [ -d "$_nativedir" ]; then
    
      76        find "$_nativedir" -name "*win32*" -exec rm -rf {} + 2>/dev/null || true
    
      77        find "$_nativedir" -name "*darwin*" -exec rm -rf {} + 2>/dev/null || true
    
      78        rm -rf "$_nativedir/dpapi"
    
      79
    
      80        if [ "$CARCH" = "x86_64" ]; then
    
      81            find "$_nativedir" -name "*arm64*" -exec rm -rf {} + 2>/dev/null || true
    
      82        elif [ "$CARCH" = "aarch64" ]; then
    
      83            find "$_nativedir" -name "*x64*" -exec rm -rf {} + 2>/dev/null || true
    
      84        fi
    
      85    fi
    
      86
    
      87    cat > "${_appdir}/loadNapCat.js" << 'EOF'
    
      88(async () => {
    
      89    const os = require('os');
    
      90    const path = require('path');
    
      91    const target = path.join(os.homedir(), '.config', 'napcat-qq-plugin', 'napcat.mjs');
    
      92    await import('file://' + target);
    
      93})();
    
      94EOF
    
      95
    
      96    install -Dm755 "${srcdir}/libnapcat_launcher.so" "${pkgdir}/opt/napcat-qq/libnapcat_launcher.so"
    
      97
    
      98    # 安装启动脚本
    
      99    install -Dm755 "${srcdir}/napcat-qq.sh" "${pkgdir}/usr/bin/napcat-qq"
    
      100}
    
      101

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Yuzuki <lxf74663@gmail.com>
 pkgname=napcat-qq
-pkgver=4.18.9
+pkgver=4.18.13
 pkgrel=1
 pkgdesc="现代化的基于 NTQQ 的 Bot 协议端实现"
 arch=('x86_64' 'aarch64')
@@ -16,7 +16,7 @@
         "napcat-qq.install"
         "launcher.cpp")
 
-sha256sums=('e729346240e1bfc51bd924cac8dbe13f4996d3ba78572dbb08a313b3874426d5'
+sha256sums=('85bb5b889caa61a5e671bf1b07ddb27d8b0a69f5a68016a3480aeff2ae220d03'
             'aeead48bc5d3e00ae7fd67d1b31b98d79ec5283210d21a69b3521537cbcea39c'
             'fecf169a5e052b9b475d9c28594f5f57557c4424391bf1e6190e2d1a33eeb8e2'
             '601b88813a8563dcd71c7961fc34a9b352226671e31aa603faa9f0f4fe54995a')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 09:20:02	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2