neatimage

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 $pkgname-$pkgver.tar.gz::https://ni.neatvideo.com/demo/ni9/sld/NeatImage9SL.Demo.Intel64.tgz

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads a prebuilt binary installer (.run file) from ni.neatvideo.com, which is the official vendor domain for Neat Image (neatvideo.com). The host is not a random personal or unofficial mirror — it is the product's own download server. However, the package executes a self-extracting .run installer binary directly (./NeatImage9SL.Demo.Intel64.run --mode silent), which is a prebuilt opaque binary blob with no source-level verification beyond a sha512 checksum. This is a legitimate supply-chain concern: if the vendor's download server were compromised or the file replaced, the checksum would catch it, but the binary itself is fully trusted and executed with the user's privileges during package(). This is a standard pattern for proprietary software AUR packages (similar to google-chrome, zoom, etc.) and is not malicious, but it does represent a real medium-severity supply-chain risk due to the executed binary from a vendor host with no reproducible build. The 'demo' path in the URL and the installer returning exit code 1 on success are slightly unusual but not security-relevant. Overall this is a legitimate proprietary software package following common AUR conventions for closed-source software, making it closer to clean/low, but the executed binary blob justifies retaining medium.