nui-sftp

maintainer 5cript · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD pulls two assets (an SVG icon and an icons tarball) from s3.g.s4.mega.io, which is MEGA's S3-compatible object storage. While MEGA is a legitimate cloud storage provider, this is not the project's official release infrastructure — it's a personal/third-party storage bucket. The frontend tarball (nui-sftp-linux-frontend_${pkgver}.tar.gz) is correctly fetched from the official GitHub releases page and has a sha256sum, which is good. The icons.tar.gz and SVG from MEGA also have sha256sums pinned, which mitigates the risk somewhat. However, the icons.tar.gz is unpacked and its contents placed into the package installation, and the SVG is installed as an icon — these are data files, not executed code. The main binary is built from source (git+github). The real concern is that the MEGA bucket (identified by a long random-looking key in the URL) is controlled by the maintainer or an unknown third party, and if that bucket is compromised or the content swapped before the sha256sum was pinned, malicious data could have been introduced. Since the sha256sums are pinned and the files are data (SVG, icons) rather than executed binaries or libraries, the actual exploitability is low, but the non-standard hosting of package assets remains a legitimate supply-chain concern worth flagging as medium.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 "https://s3.g.s4.mega.io/jgemkib4a5fte35rktt5wxrwkw4ejk4ybemkf/nui-scp/images/NUI-SFTP_Logo-01_nopad.svg"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD pulls two assets (an SVG icon and an icons tarball) from s3.g.s4.mega.io, which is MEGA's S3-compatible object storage. While MEGA is a legitimate cloud storage provider, this is not the project's official release infrastructure — it's a personal/third-party storage bucket. The frontend tarball (nui-sftp-linux-frontend_${pkgver}.tar.gz) is correctly fetched from the official GitHub releases page and has a sha256sum, which is good. The icons.tar.gz and SVG from MEGA also have sha256sums pinned, which mitigates the risk somewhat. However, the icons.tar.gz is unpacked and its contents placed into the package installation, and the SVG is installed as an icon — these are data files, not executed code. The main binary is built from source (git+github). The real concern is that the MEGA bucket (identified by a long random-looking key in the URL) is controlled by the maintainer or an unknown third party, and if that bucket is compromised or the content swapped before the sha256sum was pinned, malicious data could have been introduced. Since the sha256sums are pinned and the files are data (SVG, icons) rather than executed binaries or libraries, the actual exploitability is low, but the non-standard hosting of package assets remains a legitimate supply-chain concern worth flagging as medium.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tim Ebbeke <tim 06 tr (at) gmail dot com>
    
      2
    
      3pkgname=nui-sftp
    
      4pkgver=1.3.1
    
      5pkgrel=1
    
      6pkgdesc="NUI-based SFTP application"
    
      7arch=('x86_64')
    
      8url="https://github.com/5cript/nui-sftp"
    
      9license=('MIT')
    
      10depends=(
    
      11    webkitgtk-6.0
    
      12    curl
    
      13    crypto++
    
      14    libssh
    
      15    fmt
    
      16    boost
    
      17    boost-libs
    
      18    nlohmann-json
    
      19    sdbus-cpp
    
      20    zlib
    
      21    bzip2
    
      22    zstd
    
      23    xz
    
      24)
    
      25makedepends=(
    
      26    cmake
    
      27    ninja
    
      28    clang
    
      29    lld
    
      30    git
    
      31    python
    
      32    nodejs
    
      33)
    
      34options=('!debug')
    
      35source=(
    
      36    "$pkgname::git+$url.git#tag=v${pkgver//_/-}"
    
      37    "https://s3.g.s4.mega.io/jgemkib4a5fte35rktt5wxrwkw4ejk4ybemkf/nui-scp/images/NUI-SFTP_Logo-01_nopad.svg"
    
      38    "https://github.com/5cript/nui-sftp/releases/download/v${pkgver}/nui-sftp-linux-frontend_${pkgver}.tar.gz"
    
      39    "https://s3.g.s4.mega.io/jgemkib4a5fte35rktt5wxrwkw4ejk4ybemkf/nui-scp/icons.tar.gz"
    
      40)
    
      41sha256sums=(
    
      42    'a46c1c3ad1551a20005b0a3119d8ff607af046bc0927d7a041a78b558a911417'
    
      43    'cf0fc442069dfd28bd8b7769da6dfdca92111044ea9817197716ed9bfada3869'
    
      44    'a8ac5edaac2a1b4ce21d48c90f0c3502572b5f3ec1ed225aa42f5c97c10d1caf'
    
      45    '30ffa48c3a509e878db31a1e5d80376242852e34d9c2aa3b44d2e3d1da2ce32e'
    
      46)
    
      47
    
      48prepare() {
    
      49    cd "$pkgname"
    
      50    git submodule update --init --recursive
    
      51}
    
      52
    
      53build() {
    
      54    cd "$pkgname"
    
      55
    
      56    cmake -B "$srcdir/$pkgname/build" \
    
      57        -S "$srcdir/$pkgname" \
    
      58        -G Ninja \
    
      59        -DCMAKE_BUILD_TYPE=Release \
    
      60        -DFORCED_PROJECT_VERSION="$pkgver" \
    
      61        -DCMAKE_C_COMPILER=clang \
    
      62        -DCMAKE_CXX_COMPILER=clang++ \
    
      63        -DCMAKE_LINKER=lld \
    
      64        -DCMAKE_CXX_STANDARD=23 \
    
      65        -DOMIT_FRONTEND_BUILD=ON \
    
      66        -DNUI_FETCH_TRAITS=OFF
    
      67
    
      68    cmake --build "$srcdir/$pkgname/build"
    
      69}
    
      70
    
      71package() {
    
      72    # Create directories
    
      73    mkdir -p "$pkgdir"/usr/bin
    
      74    mkdir -p "$pkgdir"/opt/"$pkgname"
    
      75    mkdir -p "$pkgdir"/opt/"$pkgname"/bin
    
      76    mkdir -p "$pkgdir"/opt/"$pkgname"/frontend
    
      77    mkdir -p "$pkgdir"/opt/"$pkgname"/assets
    
      78    mkdir -p "$pkgdir"/opt/"$pkgname"/assets/icons
    
      79    mkdir -p "$pkgdir"/opt/"$pkgname"/themes
    
      80
    
      81    # Unpack frontend tarball
    
      82    tar -xzf "$srcdir/nui-sftp-linux-frontend_${pkgver//_/-}.tar.gz" -C "$pkgdir"/opt/"$pkgname"/frontend --strip-components=1
    
      83
    
      84    # Copy files
    
      85    install -m755 "$srcdir/$pkgname/build/bin/$pkgname" "$pkgdir"/opt/"$pkgname"/bin/"$pkgname"
    
      86    cp -r "$srcdir/$pkgname/static/assets" "$pkgdir"/opt/"$pkgname"/
    
      87    install -m644 "$srcdir/$pkgname/LICENSE" "$pkgdir"/opt/"$pkgname"/LICENSE
    
      88    cp -r "$srcdir/$pkgname/themes/." "$pkgdir"/opt/"$pkgname"/themes/
    
      89    tar -xzf "$srcdir/icons.tar.gz" -C "$pkgdir"/opt/"$pkgname"/assets/icons --strip-components=0
    
      90
    
      91    # Desktop
    
      92    install -Dm644 "$srcdir/$pkgname/org.nuicpp.nui_sftp.desktop" "$pkgdir"/usr/share/applications/"$pkgname".desktop
    
      93    install -Dm644 "NUI-SFTP_Logo-01_nopad.svg" "$pkgdir"/usr/share/icons/hicolor/scalable/apps/nui_sftp.svg
    
      94    install -Dm644 "NUI-SFTP_Logo-01_nopad.svg" "$pkgdir"/opt/"$pkgname"/assets/icons/nui-sftp-logo.svg
    
      95
    
      96    ln -s "/opt/$pkgname/bin/$pkgname" "$pkgdir"/usr/bin/"$pkgname"
    
      97}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2