nordpass-bin

maintainer hristov · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD fetches a prebuilt binary snap from api.snapcraft.io at parse time (outside source=()) and installs it with sha256sums=('SKIP'). While api.snapcraft.io is the official Snap Store API (Canonical's infrastructure), the pattern of resolving the download URL dynamically at parse time and skipping checksum verification means there is no integrity guarantee on the executed binary. If the Snap Store API or the CDN behind it were compromised, or if the URL were manipulated in transit (no TLS pinning, plain HTTP used for the API call), a malicious binary could be installed. The binary is then extracted via unsquashfs and its contents placed directly into /opt and /usr/bin. This is a real supply-chain concern: an executed binary from an external host with no checksum. However, the host itself (api.snapcraft.io) is Canonical's official Snap Store, which is a legitimate upstream source for snap packages, making this more of a packaging quality issue (SKIP checksum, HTTP not HTTPS for API call) than a clear attack. The medium rating is appropriate: it is sloppy and introduces supply-chain risk, but is not clearly malicious.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:3 _snapinfo=$(curl -sH 'Snap-Device-Series: 16' http://api.snapcraft.io/v2/snaps/info/nordpass)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD fetches a prebuilt binary snap from api.snapcraft.io at parse time (outside source=()) and installs it with sha256sums=('SKIP'). While api.snapcraft.io is the official Snap Store API (Canonical's infrastructure), the pattern of resolving the download URL dynamically at parse time and skipping checksum verification means there is no integrity guarantee on the executed binary. If the Snap Store API or the CDN behind it were compromised, or if the URL were manipulated in transit (no TLS pinning, plain HTTP used for the API call), a malicious binary could be installed. The binary is then extracted via unsquashfs and its contents placed directly into /opt and /usr/bin. This is a real supply-chain concern: an executed binary from an external host with no checksum. However, the host itself (api.snapcraft.io) is Canonical's official Snap Store, which is a legitimate upstream source for snap packages, making this more of a packaging quality issue (SKIP checksum, HTTP not HTTPS for API call) than a clear attack. The medium rating is appropriate: it is sloppy and introduces supply-chain risk, but is not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Hristo Voyvodov <hristo.voyvodov@hotmail.com>
    
      2# Contributor: Carson Mullins <SeptemAUR@pm.me>
    
      3_snapinfo=$(curl -sH 'Snap-Device-Series: 16' http://api.snapcraft.io/v2/snaps/info/nordpass)
    
      4_snapdownloadurl=$(sed -E 's/.*"download":?[^}]*"url":"?([^,"]*)"?.*/\1/' <<< "${_snapinfo}" | xargs)
    
      5pkgname='nordpass-bin'
    
      6pkgver=$(sed -E 's/.*"version":"?([^,"]*)"?.*/\1/' <<< "${_snapinfo}" | xargs)
    
      7pkgrel=0
    
      8pkgdesc="NordPass password manager (Snap release)"
    
      9arch=('x86_64')
    
      10url='https://nordpass.com'
    
      11license=('custom')
    
      12depends=('gtk3' 'libsecret' 'alsa-lib' 'nss')
    
      13makedepends=('squashfs-tools' )
    
      14options=('!strip')
    
      15provides=('nordpass')
    
      16
    
      17source=('LICENSE'
    
      18        "${_snapdownloadurl}")
    
      19sha256sums=('88798af2f6f88ea827870c47cc7bdcac61a4a39a32cd7ed0b2682a6150369e4c'
    
      20            'SKIP')
    
      21
    
      22prepare ()
    
      23{
    
      24  unsquashfs -force -quiet -dest "${srcdir}/${pkgname}" "${_snapdownloadurl##*/}"
    
      25}
    
      26
    
      27package ()
    
      28{
    
      29  # Install files
    
      30  install -d "${pkgdir}/opt/${pkgname}"
    
      31  cp -r "${srcdir}/${pkgname}/." "${pkgdir}/opt/${pkgname}"
    
      32
    
      33  # Desktop Entry
    
      34  sed -i 's|${SNAP}/meta/gui/icon.png|nordpass|g' \
    
      35	  "${pkgdir}/opt/${pkgname}/meta/gui/nordpass.desktop"
    
      36  install -Dm644 "${pkgdir}/opt/${pkgname}/meta/gui/nordpass.desktop" \
    
      37	  -t "${pkgdir}/usr/share/applications"
    
      38  install -Dm644 "${pkgdir}/opt/${pkgname}/meta/gui/icon.png" \
    
      39	  "${pkgdir}/usr/share/pixmaps/nordpass.png"
    
      40
    
      41  # Clean up unnecessary files
    
      42  rm -rf "${pkgdir}/opt/${pkgname}"/{data-dir,gnome-platform,lib,meta,scripts,usr,*.sh}
    
      43
    
      44  # Symlink binary to /usr/bin
    
      45  install -d "${pkgdir}/usr/bin"
    
      46  ln -s "/opt/${pkgname}/nordpass" "${pkgdir}/usr/bin"
    
      47
    
      48  # Install license
    
      49  # https://my.nordaccount.com/legal/terms-of-service/
    
      50  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2