noip

maintainer runnytu · 54 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a tarball from a CloudFront CDN URL (dmej8g5cpdyqd.cloudfront.net) rather than directly from no-ip.com's official download servers. While no-ip.com does use CloudFront as their CDN, this specific distribution URL is not directly verifiable as the canonical official source. More importantly, the package extracts a prebuilt Debian binary package (.deb) and installs its binaries directly — this is an executed binary from a non-standard/CDN host rather than compiled from source. The sha512sums provide integrity checking, but they only protect against accidental corruption or a one-time swap, not against a compromised upstream host that consistently serves the same malicious binary. The binary is a DDNS client daemon that runs as a systemd service with network access, making the impact of any compromise significant. This is a genuine medium-severity supply-chain concern: prebuilt binary from a non-canonical host, installed and run as a system service, even though the CloudFront URL is plausibly the vendor's own CDN.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=('https://dmej8g5cpdyqd.cloudfront.net/downloads/noip-duc_3.3.0.tar.gz'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a tarball from a CloudFront CDN URL (dmej8g5cpdyqd.cloudfront.net) rather than directly from no-ip.com's official download servers. While no-ip.com does use CloudFront as their CDN, this specific distribution URL is not directly verifiable as the canonical official source. More importantly, the package extracts a prebuilt Debian binary package (.deb) and installs its binaries directly — this is an executed binary from a non-standard/CDN host rather than compiled from source. The sha512sums provide integrity checking, but they only protect against accidental corruption or a one-time swap, not against a compromised upstream host that consistently serves the same malicious binary. The binary is a DDNS client daemon that runs as a systemd service with network access, making the impact of any compromise significant. This is a genuine medium-severity supply-chain concern: prebuilt binary from a non-canonical host, installed and run as a system service, even though the CloudFront URL is plausibly the vendor's own CDN.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Runnytu < runnytu at gmail dot com >
    
      2# Contributor: Alexander Rødseth <rodseth@gmail.com>
    
      3# Contributor: Daenyth
    
      4# Contributor: Lyle Putnam <lcputnam@amerytel.net>
    
      5
    
      6pkgname=noip
    
      7pkgver=3.3.0
    
      8pkgrel=1
    
      9pkgdesc='Dynamic DNS Client Updater for no-ip.com services'
    
      10arch=('x86_64' 'i686' 'armv7h' 'armv6h' 'aarch64')
    
      11url='http://www.no-ip.com/downloads.php?page=linux'
    
      12license=('GPL')
    
      13install="$pkgname.install"
    
      14depends=('glibc')
    
      15source=('https://dmej8g5cpdyqd.cloudfront.net/downloads/noip-duc_3.3.0.tar.gz'
    
      16        'noip.service')
    
      17sha512sums=('5d9ef7a6bc355d55b23b52ac6b9cd7c8b95a0c8196108a3c8384fe34cc588a7e7f9b40ccf7649b2500c251707feb42fb2646a6fc2deee60d7c34fcb40734e3a8'
    
      18            '6949972af4a0b71c0f1e57230a78757b47799bbc50050ebf74893603ace6a0e959dbb4cb4523bb992d579f1369ee1e008c67f270cd6d670ad88d176485704856')
    
      19
    
      20package() {
    
      21  tar xf noip-duc_3.3.0.tar.gz
    
      22  cd "$pkgname-duc_$pkgver/binaries"
    
      23  ar xf noip-duc_3.3.0_amd64.deb
    
      24  tar xf data.tar.xz
    
      25  mv usr "${pkgdir}"
    
      26  rm -fr noip-duc_3.3.0
    
      27
    
      28  install -d "$pkgdir/usr/"
    
      29  install -Dm644 "$srcdir/$pkgname.service" \
    
      30    "$pkgdir/usr/lib/systemd/system/noip.service"
    
      31}
    
      32
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2