necta-wifi-mouse

maintainer joposter · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt binary .deb packages from wifimouse.necta.us (the official vendor site for the WiFi Mouse product, matching the pkgurl), extracts them, and installs the compiled binary 'mouseserver' directly onto the system. The host is the upstream vendor's own domain, not a random personal host, which reduces but does not eliminate supply-chain risk. Key concerns: (1) binaries are downloaded over plain HTTP with only MD5 checksums (no HTTPS, no stronger hash like SHA256/SHA512), meaning the download is vulnerable to MITM substitution and the integrity check is weak; (2) a prebuilt closed-source binary is being executed — despite the license claiming GPL2, there is no source build, which is suspicious; (3) the prepare() function attempts to extract data.tar.gz but there is no ar extraction step to unpack the .deb first, making this likely broken in practice. The combination of HTTP-only delivery, weak MD5 integrity, and direct execution of a prebuilt binary from a vendor host constitutes a genuine medium supply-chain concern, consistent with the cheaper model's assessment.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("mouseserver.deb::http://wifimouse.necta.us/apk/mouseserver-64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads prebuilt binary .deb packages from wifimouse.necta.us (the official vendor site for the WiFi Mouse product, matching the pkgurl), extracts them, and installs the compiled binary 'mouseserver' directly onto the system. The host is the upstream vendor's own domain, not a random personal host, which reduces but does not eliminate supply-chain risk. Key concerns: (1) binaries are downloaded over plain HTTP with only MD5 checksums (no HTTPS, no stronger hash like SHA256/SHA512), meaning the download is vulnerable to MITM substitution and the integrity check is weak; (2) a prebuilt closed-source binary is being executed — despite the license claiming GPL2, there is no source build, which is suspicious; (3) the prepare() function attempts to extract data.tar.gz but there is no ar extraction step to unpack the .deb first, making this likely broken in practice. The combination of HTTP-only delivery, weak MD5 integrity, and direct execution of a prebuilt binary from a vendor host constitutes a genuine medium supply-chain concern, consistent with the cheaper model's assessment.

PKGBUILD

1 offending line(s) highlighted

      1# Contributer: Julian Daube <joposter (at) gmail (dot) com>
    
      2
    
      3pkgname=necta-wifi-mouse
    
      4pkgdesc="wifi mouse for android (server part)"
    
      5pkgver=1.0.2
    
      6pkgrel=1
    
      7arch=("x86_64" "i686")
    
      8url=http://wifimouse.necta.us/
    
      9
    
      10license=("GPL2")
    
      11source=("icon.png")
    
      12source_x86_64=("mouseserver.deb::http://wifimouse.necta.us/apk/mouseserver-64.deb")
    
      13source_i686=("mouseserver.deb::http://wifimouse.necta.us/apk/mouseserver-32.deb")
    
      14
    
      15depends=() 
    
      16makedepends=("sed" "tar")
    
      17
    
      18prepare() {
    
      19	# extract data portion of deb file
    
      20	tar -xf "$srcdir/data.tar.gz"	
    
      21}
    
      22
    
      23package() {
    
      24	# create destination directories
    
      25	mkdir -p "$pkgdir/usr/bin"
    
      26	mkdir -p "$pkgdir/usr/share/applications"
    
      27	mkdir -p "$pkgdir/usr/share/mouseserver/icons"
    
      28	mkdir -p "$pkgdir/usr/share/icons/hicolor/128x128/apps/"
    
      29	
    
      30	# install files
    
      31	install -m 775 "$srcdir/usr/sbin/mouseserver" "$pkgdir/usr/bin"
    
      32	install -m 664 "$srcdir/usr/share/applications/mouseserver.desktop" "$pkgdir/usr/share/applications/mouseserver.desktop"
    
      33	install -m 664 "$srcdir/icon.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/mouseserver.png"
    
      34	install -m 644 -D "$srcdir/usr/share/mouseserver/icons/"* "$pkgdir/usr/share/mouseserver/icons"
    
      35
    
      36	# modify desktop file
    
      37	desktopfile="$pkgdir/usr/share/applications/mouseserver.desktop"
    
      38	sed -i 's/Exec=.*$/Exec=\/usr\/bin\/mouseserver/'                                       "$desktopfile"
    
      39	sed -i 's/Icon=.*$/Icon=\/usr\/share\/icons\/hicolor\/128x128\/apps\/mouseserver.png/' "$desktopfile"
    
      40}
    
      41
    
      42
    
      43md5sums=('671cbe35275357e3a42aa118a7e35a8f')
    
      44md5sums_x86_64=('2db5e825e61be4c3d8f391e978b75cd3')
    
      45md5sums_i686=('125a616a9af78a9a6552ec49e8f32571')
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2