nhaccuatui

maintainer nanoka · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from apps.nhaccuatui.com, which is the official vendor domain for the NhacCuaTui music streaming service (matching the package URL). The AppImage is installed as an executable and symlinked into /usr/bin. While the host appears to be the legitimate vendor (same domain as the declared url=), it is still a proprietary binary blob from a non-redistributed, non-auditable source with no upstream signing/verification beyond a sha256sum. The sha256sum provides integrity but not authenticity — if the vendor host is compromised or the file is silently replaced, users execute arbitrary code. Three other source files (LICENSE, PNG, desktop file) are sourced without a declared origin URL, meaning they are expected to be pre-placed in the build directory, which is unusual and slightly suspicious but likely just local files committed to the AUR git repo. Overall this is a legitimate vendor AppImage packaging pattern common in the AUR, but the executed binary from a proprietary/unofficial host with no GPG signature warrants a medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "http://apps.nhaccuatui.com/download/NhacCuaTui-${pkgver}.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from apps.nhaccuatui.com, which is the official vendor domain for the NhacCuaTui music streaming service (matching the package URL). The AppImage is installed as an executable and symlinked into /usr/bin. While the host appears to be the legitimate vendor (same domain as the declared url=), it is still a proprietary binary blob from a non-redistributed, non-auditable source with no upstream signing/verification beyond a sha256sum. The sha256sum provides integrity but not authenticity — if the vendor host is compromised or the file is silently replaced, users execute arbitrary code. Three other source files (LICENSE, PNG, desktop file) are sourced without a declared origin URL, meaning they are expected to be pre-placed in the build directory, which is unusual and slightly suspicious but likely just local files committed to the AUR git repo. Overall this is a legitimate vendor AppImage packaging pattern common in the AUR, but the executed binary from a proprietary/unofficial host with no GPG signature warrants a medium rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nguyen Hoang Ky <nhktmdzhg at gmail dot com>
    
      2pkgname=nhaccuatui
    
      3pkgver=2.0.0
    
      4pkgrel=1
    
      5pkgdesc="Nghe nhạc mọi lúc mọi nơi"
    
      6arch=('x86_64')
    
      7url="https://apps.nhaccuatui.com"
    
      8license=("LicenseRef-Nhaccuatui")
    
      9depends=(
    
      10    'glibc'
    
      11    'zlib-ng-compat'
    
      12)
    
      13options=(!strip)
    
      14source=(
    
      15    "http://apps.nhaccuatui.com/download/NhacCuaTui-${pkgver}.AppImage"
    
      16    "LICENSE.electron.txt"
    
      17    "nhaccuatui-desktop.png"
    
      18    "nhaccuatui.desktop"
    
      19)
    
      20sha256sums=(
    
      21    '0f48960234fbf094090eb54e8574803575bf71c6eeb9dbf5ab2cbdb95b26a666'
    
      22    '34f6f27c26d1bb8682ebb42ae401f558228fd608455bd7c6561d5fd500b7d05b'
    
      23    '345769d914aa7e09db98538a9278f7fa871de8fea2bec04c2e4f0ac4a032aa70'
    
      24    '44166dd75c7e5b46193eb830cf97b72829e8b7c2dd58c79befcbadf95c532b72'
    
      25)
    
      26
    
      27package() {
    
      28    install -Dm644 "$srcdir/LICENSE.electron.txt" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      29    install -Dm644 "$srcdir/nhaccuatui-desktop.png" "$pkgdir/opt/${pkgname}/nhaccuatui-desktop.png"
    
      30    install -Dm644 "$srcdir/nhaccuatui.desktop" "$pkgdir/usr/share/applications/${pkgname}.desktop"
    
      31
    
      32    install -Dm755 "$srcdir/NhacCuaTui-${pkgver}.AppImage" "$pkgdir/opt/${pkgname}/nhaccuatui-desktop"
    
      33    install -d "$pkgdir/usr/bin"
    
      34    ln -s "/opt/${pkgname}/nhaccuatui-desktop" "$pkgdir/usr/bin/${pkgname}"
    
      35
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2