netease-songrec-linux-bin

MEDIUM

maintainer OctoberPrayRain 0 votes scanned 2026-10-21 09:34:42.862631

View on AUR

Why flagged

Installs a prebuilt binary from the maintainer's own GitHub releases (not an official vendor), and downloads a Chrome extension from Google's CRX service which is then processed by a bundled Python script at build time; the binary is unverifiable beyond the checksum and comes from a personal project with few votes, making silent substitution a realistic supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 "${_extension}::https://clients2.google.com/service/update2/crx?response=redirect&prodversion=130.0.0.0&acceptformat=crx3&x=id%3Dkemcalcncfhmdkgglekijclbomdoohkp%26installsource%3Dondemand%26uc")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary from the maintainer's own GitHub releases (not an official vendor), and downloads a Chrome extension from Google's CRX service which is then processed by a bundled Python script at build time; the binary is unverifiable beyond the checksum and comes from a personal project with few votes, making silent substitution a realistic supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# SPDX-License-Identifier: AGPL-3.0-only
    
      2# Maintainer: OctoberPrayRain
    
      3pkgname=netease-songrec-linux-bin
    
      4pkgver=0.1.1
    
      5pkgrel=1
    
      6pkgdesc='Unofficial NetEase Music song recognition client for Linux'
    
      7arch=('x86_64')
    
      8url='https://github.com/OctoberPrayRain/NeteaseSongRec_Linux'
    
      9license=('AGPL-3.0-only' 'GPL-3.0-or-later' 'LicenseRef-NetEase-Extension')
    
      10depends=('alsa-lib' 'fontconfig' 'freetype2' 'gcc-libs' 'glibc' 'hicolor-icon-theme' 'libglvnd'
    
      11         'libpulse' 'libx11' 'libxcursor' 'libxi' 'libxkbcommon'
    
      12         'libxkbcommon-x11' 'libxrandr' 'nodejs' 'pipewire' 'python' 'wayland')
    
      13optdepends=('pipewire-pulse: PulseAudio-compatible system playback monitor'
    
      14            'noto-fonts-cjk: Chinese interface fonts')
    
      15provides=('netease-songrec-linux')
    
      16conflicts=('netease-songrec-linux')
    
      17options=('!strip' '!debug')
    
      18_archive="netease-songrec-linux-${pkgver}-linux-${CARCH}"
    
      19_extension='NetEase-1.0.4.crx'
    
      20source=("${_archive}.tar.gz::${url}/releases/download/v${pkgver}/${_archive}.tar.gz"
    
      21        "${_extension}::https://clients2.google.com/service/update2/crx?response=redirect&prodversion=130.0.0.0&acceptformat=crx3&x=id%3Dkemcalcncfhmdkgglekijclbomdoohkp%26installsource%3Dondemand%26uc")
    
      22noextract=("${_extension}")
    
      23sha256sums=('28ba839e85c6645938f4bd0bc55130128d455b521c0eed0f2d43a58801d2e506'
    
      24            'ef746443a0f240c525b6cdf8ff6cf27ab22f4ac0399cd3b2564452e753ce3b75')
    
      25
    
      26prepare() {
    
      27    local data_dir="${srcdir}/${_archive}/share/netease-songrec-linux"
    
      28    python "${data_dir}/scripts/sync-netease-resources.py" \
    
      29        --archive "${srcdir}/${_extension}" \
    
      30        --cache-dir "${srcdir}/netease-extension" \
    
      31        --destination "${data_dir}"
    
      32}
    
      33
    
      34package() {
    
      35    cd "${srcdir}/${_archive}"
    
      36    install -Dm755 bin/netease-songrec-linux "${pkgdir}/usr/bin/netease-songrec-linux"
    
      37    install -d "${pkgdir}/usr/share"
    
      38    cp -r share/. "${pkgdir}/usr/share/"
    
      39    mv "${pkgdir}/usr/share/licenses/netease-songrec-linux" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 09:34:42	Medium	3
2026-10-21 09:31:11	Medium	3