naver-whale-stable

maintainer ls4154 · 6 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from Naver's official repository domain (repo.whale.naver.com), which is plausibly the project's own infrastructure; the source is not from a swappable host like a generic file host, and the package installs only static assets and binaries from that official source, posing no active execution of remote code or obfuscated payloads.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Naver's official repository domain (repo.whale.naver.com), which is plausibly the project's own infrastructure; the source is not from a swappable host like a generic file host, and the package installs only static assets and binaries from that official source, posing no active execution of remote code or obfuscated payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("https://repo.whale.naver.com/stable/deb/pool/main/n/naver-whale-stable/naver-whale-stable_${pkgver}-1_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Youngjae Lee <ls4154.lee@gmail.com>
    
      2pkgname=naver-whale-stable
    
      3pkgver=4.38.386.14
    
      4pkgrel=1
    
      5pkgdesc="The web browser from NAVER"
    
      6arch=("x86_64")
    
      7url="https://whale.naver.com"
    
      8license=("custom")
    
      9depends=(
    
      10	'alsa-lib'
    
      11	'gtk3'
    
      12	'libcups'
    
      13	'libxss'
    
      14	'libxtst'
    
      15	'nss'
    
      16	'ttf-liberation'
    
      17	'xdg-utils'
    
      18)
    
      19options=('!emptydirs' '!strip')
    
      20install=$pkgname.install
    
      21source=("https://repo.whale.naver.com/stable/deb/pool/main/n/naver-whale-stable/naver-whale-stable_${pkgver}-1_amd64.deb"
    
      22	"naver-whale-stable.sh"
    
      23	"LICENSE.html")
    
      24sha256sums=("6dd7ebc47d7e8f21da1108ad5b0e17fcd562fd92e684da206564b51476e0b47e"
    
      25	"11522689f4c94ea86bc7e50feb48c6b823cb3cdb7bb04b565a0db2f12d25d9a5"
    
      26	"ed82f8f83c93cbd468395cc80e3be7beb8a3f18bdf5770f165c348c15f7e5e84")
    
      27
    
      28package() {
    
      29	bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      30
    
      31	install -m755 naver-whale-stable.sh "${pkgdir}/usr/bin/naver-whale-stable"
    
      32
    
      33	install -Dm644 LICENSE.html "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.html"
    
      34
    
      35	for i in 16 24 32 48 64 128 256; do
    
      36		install -Dm644 "${pkgdir}/opt/naver/whale/product_logo_${i}.png" \
    
      37			"${pkgdir}/usr/share/icons/hicolor/${i}x${i}/apps/naver-whale.png"
    
      38	done
    
      39
    
      40	rm -rf "${pkgdir}/etc/cron.daily/" \
    
      41		"${pkgdir}/opt/naver/whale/cron/" \
    
      42		"${pkgdir}/opt/naver/whale"/product_logo_*.{png,xpm} \
    
      43		"${pkgdir}/usr/share/menu/"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2