netpad-player

maintainer AsukaMinato · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows .exe installer from www.netpad.net.cn (the official project website) and extracts its embedded Electron app.asar bundle using asar, then runs it under the system electron. The host appears to be the legitimate upstream vendor site for this Chinese math education software, so this is not an obviously unofficial or personal host. However, the concern is real: (1) a prebuilt binary blob (the .exe contains an app.asar with JavaScript code) is downloaded and executed — the sha256sum pins the specific version, which mitigates silent substitution but not a compromised upstream; (2) the JavaScript extracted from the asar runs with full Electron/Node.js privileges and is not auditable at package-review time; (3) the source is a Windows installer repurposed for Linux, which is an unusual and non-transparent packaging pattern. This is a genuine medium-severity supply-chain concern: executed code from a third-party host with no reproducible build, even if the host appears to be the official vendor.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "https://www.netpad.net.cn/download/NetpadPlayer-${pkgver}.exe")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows .exe installer from www.netpad.net.cn (the official project website) and extracts its embedded Electron app.asar bundle using asar, then runs it under the system electron. The host appears to be the legitimate upstream vendor site for this Chinese math education software, so this is not an obviously unofficial or personal host. However, the concern is real: (1) a prebuilt binary blob (the .exe contains an app.asar with JavaScript code) is downloaded and executed — the sha256sum pins the specific version, which mitigates silent substitution but not a compromised upstream; (2) the JavaScript extracted from the asar runs with full Electron/Node.js privileges and is not auditable at package-review time; (3) the source is a Windows installer repurposed for Linux, which is an unusual and non-transparent packaging pattern. This is a genuine medium-severity supply-chain concern: executed code from a third-party host with no reproducible build, even if the host appears to be the official vendor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Asuka Minato <i at asukaminato dot eu dot org>
    
      2pkgname=netpad-player
    
      3pkgver=1.6.5
    
      4pkgrel=1
    
      5pkgdesc="网络画板，用核心技术赋能智慧数学教育"
    
      6arch=(any)
    
      7url="https://www.netpad.net.cn/"
    
      8license=('custom')
    
      9depends=(bash electron)
    
      10makedepends=(asar)
    
      11source=(
    
      12	$pkgname.desktop
    
      13	"https://www.netpad.net.cn/download/NetpadPlayer-${pkgver}.exe")
    
      14sha256sums=('6dbdb46f4ed3388b2ec5b7c90ca566c59a39bbef15e9cad5e1e9884df178d1be'
    
      15            '2f6aa71b2050bf789c5f5c0eee16e991c80101a131693d3580651a2769064733')
    
      16options=(!emptydirs)
    
      17prepare() {
    
      18	find $srcdir -name app.asar -print -exec asar e {} ./app \;
    
      19	find . -type f -path "*/darwin/*" -printf "rm %p\n" -delete
    
      20	find . -name "*.rar" -printf "rm %p\n" -delete
    
      21	find . -path "*/bin/*.js" -delete
    
      22	find . -name "*.js.map" -printf "rm %p\n" -delete
    
      23}
    
      24
    
      25package() {
    
      26	install -d $pkgdir/opt/$pkgname/
    
      27	cp -av app $pkgdir/opt/$pkgname/
    
      28	printf "#!/bin/bash
    
      29set -eux -o pipefail
    
      30exec electron /opt/$pkgname/app \"\$@\"
    
      31" | install -Dm755 /dev/stdin $pkgdir/usr/bin/netpad-player
    
      32	find $srcdir -name icon.png -print -exec install -Dm644 {} $pkgdir/usr/share/pixmaps/$pkgname.png \;
    
      33	install -vDm644 $pkgname.desktop -t $pkgdir/usr/share/applications/
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2