niceaigc-bin

MEDIUM

maintainer icepie 0 votes scanned 2026-08-31 11:48:22.259879

View on AUR

Why flagged

Installs a prebuilt binary .deb fetched from the project's own domain (app.niceaigc.net), but it is a dynamic API endpoint rather than a versioned release asset, meaning the served binary could change silently without a checksum mismatch being caught on re-download; the sha256sum provides a one-time check but the endpoint is not pinned to a specific release artifact, making it a swappable prebuilt executable from a relatively unknown host.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "niceaigc-${pkgver}.deb::https://app.niceaigc.net/api/v1/download/linux/x64?format=deb"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Installs a prebuilt binary .deb fetched from the project's own domain (app.niceaigc.net), but it is a dynamic API endpoint rather than a versioned release asset, meaning the served binary could change silently without a checksum mismatch being caught on re-download; the sha256sum provides a one-time check but the endpoint is not pinned to a specific release artifact, making it a swappable prebuilt executable from a relatively unknown host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ice Pie <icepie.dev@gmail.com>
    
      2pkgname=niceaigc-bin
    
      3pkgver=1.0.9
    
      4pkgrel=1
    
      5pkgdesc='NiceAIGC desktop application'
    
      6arch=('x86_64')
    
      7url='https://app.niceaigc.net/'
    
      8license=('custom')
    
      9depends=(
    
      10  'at-spi2-core'
    
      11  'gtk3'
    
      12  'libnotify'
    
      13  'libsecret'
    
      14  'libxss'
    
      15  'libxtst'
    
      16  'nss'
    
      17  'util-linux-libs'
    
      18  'xdg-utils'
    
      19)
    
      20optdepends=('libappindicator-gtk3: system tray integration')
    
      21provides=('niceaigc')
    
      22conflicts=('niceaigc')
    
      23source=(
    
      24  "niceaigc-${pkgver}.deb::https://app.niceaigc.net/api/v1/download/linux/x64?format=deb"
    
      25)
    
      26sha256sums=('855059a295d853a65cd2bd3d883de2b1d0fe855167cb4f6b3034c15552cc6fc6')
    
      27
    
      28prepare() {
    
      29  bsdtar -xf "${srcdir}/niceaigc-${pkgver}.deb" -C "${srcdir}"
    
      30  bsdtar -xf "${srcdir}/data.tar.xz" -C "${srcdir}"
    
      31}
    
      32
    
      33package() {
    
      34  install -d "${pkgdir}/opt/NiceAIGC" "${pkgdir}/usr"
    
      35  cp -a "${srcdir}/opt/NiceAIGC/." "${pkgdir}/opt/NiceAIGC/"
    
      36  cp -a "${srcdir}/usr/share" "${pkgdir}/usr/"
    
      37
    
      38  install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      39  install -Dm644 "${pkgdir}/opt/NiceAIGC/LICENSE.electron.txt" \
    
      40    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-31 11:48:22	Medium	3
2026-08-31 11:45:21	Medium	3