noip

MEDIUM

maintainer runnytu 54 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a tarball from a CloudFront CDN URL (dmej8g5cpdyqd.cloudfront.net) rather than directly from no-ip.com's official download servers. While no-ip.com does use CloudFront as their CDN, this specific distribution URL is not directly verifiable as the canonical official source. More importantly, the package extracts a prebuilt Debian binary package (.deb) and installs its binaries directly — this is an executed binary from a non-standard/CDN host rather than compiled from source. The sha512sums provide integrity checking, but they only protect against accidental corruption or a one-time swap, not against a compromised upstream host that consistently serves the same malicious binary. The binary is a DDNS client daemon that runs as a systemd service with network access, making the impact of any compromise significant. This is a genuine medium-severity supply-chain concern: prebuilt binary from a non-canonical host, installed and run as a system service, even though the CloudFront URL is plausibly the vendor's own CDN.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=('https://dmej8g5cpdyqd.cloudfront.net/downloads/noip-duc_3.3.0.tar.gz'

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a tarball from a CloudFront CDN URL (dmej8g5cpdyqd.cloudfront.net) rather than directly from no-ip.com's official download servers. While no-ip.com does use CloudFront as their CDN, this specific distribution URL is not directly verifiable as the canonical official source. More importantly, the package extracts a prebuilt Debian binary package (.deb) and installs its binaries directly — this is an executed binary from a non-standard/CDN host rather than compiled from source. The sha512sums provide integrity checking, but they only protect against accidental corruption or a one-time swap, not against a compromised upstream host that consistently serves the same malicious binary. The binary is a DDNS client daemon that runs as a systemd service with network access, making the impact of any compromise significant. This is a genuine medium-severity supply-chain concern: prebuilt binary from a non-canonical host, installed and run as a system service, even though the CloudFront URL is plausibly the vendor's own CDN.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Runnytu < runnytu at gmail dot com >
    
      2# Contributor: Alexander Rødseth <rodseth@gmail.com>
    
      3# Contributor: Daenyth
    
      4# Contributor: Lyle Putnam <lcputnam@amerytel.net>
    
      5
    
      6pkgname=noip
    
      7pkgver=3.3.0
    
      8pkgrel=1
    
      9pkgdesc='Dynamic DNS Client Updater for no-ip.com services'
    
      10arch=('x86_64' 'i686' 'armv7h' 'armv6h' 'aarch64')
    
      11url='http://www.no-ip.com/downloads.php?page=linux'
    
      12license=('GPL')
    
      13install="$pkgname.install"
    
      14depends=('glibc')
    
      15source=('https://dmej8g5cpdyqd.cloudfront.net/downloads/noip-duc_3.3.0.tar.gz'
    
      16        'noip.service')
    
      17sha512sums=('5d9ef7a6bc355d55b23b52ac6b9cd7c8b95a0c8196108a3c8384fe34cc588a7e7f9b40ccf7649b2500c251707feb42fb2646a6fc2deee60d7c34fcb40734e3a8'
    
      18            '6949972af4a0b71c0f1e57230a78757b47799bbc50050ebf74893603ace6a0e959dbb4cb4523bb992d579f1369ee1e008c67f270cd6d670ad88d176485704856')
    
      19
    
      20package() {
    
      21  tar xf noip-duc_3.3.0.tar.gz
    
      22  cd "$pkgname-duc_$pkgver/binaries"
    
      23  ar xf noip-duc_3.3.0_amd64.deb
    
      24  tar xf data.tar.xz
    
      25  mv usr "${pkgdir}"
    
      26  rm -fr noip-duc_3.3.0
    
      27
    
      28  install -d "$pkgdir/usr/"
    
      29  install -Dm644 "$srcdir/$pkgname.service" \
    
      30    "$pkgdir/usr/lib/systemd/system/noip.service"
    
      31}
    
      32
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2