nhiicc

MEDIUM

maintainer imrehg 5 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt executable from a non-standard, non-whitelisted host (cloudicweb.nhi.gov.tw) which could be subject to supply-chain tampering, though it appears to be the official source for the software.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("CMS_mNHIICC_Setup-$pkgver.Linux.zip"::"https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/CMS_mNHIICC_Setup.Linux.zip"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt executable from a non-standard, non-whitelisted host (cloudicweb.nhi.gov.tw) which could be subject to supply-chain tampering, though it appears to be the official source for the software.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Chih-Hsuan Yen <base64_decode("eXUzYWN0eHQydHR0ZmlteEBjaHllbi5jYwo=")>
    
      2
    
      3# Testing pages:
    
      4# * https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/webtesting/SampleY.aspx
    
      5# * /usr/share/nhiicc/html/ESample.html in this package
    
      6
    
      7pkgname=nhiicc
    
      8epoch=1
    
      9pkgver=20240710.1
    
      10pkgrel=3
    
      11arch=(x86_64)
    
      12url='https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/mEventesting.htm'
    
      13license=(custom)
    
      14pkgdesc='台灣健保卡網路註冊憑證元件 (National Health Insurance IC Card)'
    
      15# sed and openssl are for commands used in nhiicc.install
    
      16depends=(pcsclite sed openssl)
    
      17makedepends=(patchelf)
    
      18optdepends=(
    
      19  'lib32-pcsclite: for using card readers with 32-bit driver only'
    
      20)
    
      21source=("CMS_mNHIICC_Setup-$pkgver.Linux.zip"::"https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/CMS_mNHIICC_Setup.Linux.zip"
    
      22        nhiicc.service
    
      23        nhiicc.rules
    
      24        regen-certs.sh)
    
      25noextract=("CMS_mNHIICC_Setup-$pkgver.Linux.zip")
    
      26# See https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/mEventesting.htm for MD5 sums
    
      27md5sums=('3bbad14d8ce82a504811319e06c3cdac'
    
      28         '3a7ba068b49eab2edca614ea2495e706'
    
      29         'e4a249ff4e638527a0bde9deec6eeb5a'
    
      30         '97e402f39fffe35e411419d062f6baf8')
    
      31install=nhiicc.install
    
      32
    
      33prepare() {
    
      34  bsdtar xOf CMS_mNHIICC_Setup-${pkgver}.Linux.zip | bsdtar x
    
      35
    
      36  # Delete insecure RUNPATH
    
      37  patchelf --remove-rpath mLNHIICC_Setup/x64/mLNHIICC
    
      38}
    
      39
    
      40package() {
    
      41  install -Dm755 mLNHIICC_Setup/x64/mLNHIICC -t "$pkgdir"/usr/bin
    
      42  install -Dm755 regen-certs.sh -t "$pkgdir"/usr/share/nhiicc/
    
      43  cp -dr mLNHIICC_Setup/html "$pkgdir"/usr/share/nhiicc/
    
      44  install -Dm644 nhiicc.service -t "$pkgdir"/usr/lib/systemd/system/
    
      45  install -Dm644 nhiicc.rules -t "$pkgdir"/usr/share/polkit-1/rules.d
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2