nx3-all

maintainer filipprochazkova · 38 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt NoMachine NX 3.5.0 binaries (nxclient, nxnode, nxserver) from http://url.muflone.com rather than from the official NoMachine download servers. These are executed binaries installed into /usr/NX and symlinked into /usr/bin, so any compromise or substitution of the maintainer-controlled mirror would result in arbitrary code execution on the user's system. The sha256sums are pinned, which mitigates the risk of silent substitution, but the binaries still come from an unofficial third-party host rather than the upstream vendor. This is a genuine supply-chain concern: the original NoMachine NX 3.x downloads are no longer available from nomachine.com, so the maintainer is re-hosting them, but there is no way to verify these match the original vendor binaries. The risk is real but not evidence of active malice, placing this squarely in the medium category.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("license.html"::"https://www.nomachine.com/licensing-3-5"
PKGBUILD:25 source_i686=("http://url.muflone.com/nxclient-3.5.0-7.i386.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads prebuilt NoMachine NX 3.5.0 binaries (nxclient, nxnode, nxserver) from http://url.muflone.com rather than from the official NoMachine download servers. These are executed binaries installed into /usr/NX and symlinked into /usr/bin, so any compromise or substitution of the maintainer-controlled mirror would result in arbitrary code execution on the user's system. The sha256sums are pinned, which mitigates the risk of silent substitution, but the binaries still come from an unofficial third-party host rather than the upstream vendor. This is a genuine supply-chain concern: the original NoMachine NX 3.x downloads are no longer available from nomachine.com, so the maintainer is re-hosting them, but there is no way to verify these match the original vendor binaries. The risk is real but not evidence of active malice, placing this squarely in the medium category.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Muflone http://www.muflone.com/contacts/english/
    
      2# Contributor: Josh VanderLinden <arch@cloudlery.com>
    
      3
    
      4pkgname=nx3-all
    
      5pkgver=3.5.0
    
      6pkgrel=4
    
      7pkgdesc="NoMachine nxclient, nxnode, and nxserver in one package (version 3.x which includes virtual desktop support)"
    
      8arch=('i686' 'x86_64')
    
      9url="https://www.nomachine.com/"
    
      10license=('custom:nomachine')
    
      11depends=('libcups' 'psmisc')
    
      12makedepends=('python-html2text')
    
      13optdepends=('openssh: SSH server for NX server'
    
      14            'tigervnc: VNC (RFB) client support'
    
      15            'rdesktop: RDP client support')
    
      16provides=('nxclient' 'nxnode' 'nxserver')
    
      17conflicts=('freenx' 'nxclient' 'nx-all')
    
      18replaces=('nx-all')
    
      19install="${pkgname}.install"
    
      20source=("license.html"::"https://www.nomachine.com/licensing-3-5"
    
      21        "nxsensor.service"
    
      22        "nxserver.service"
    
      23        "nxnode-arch.patch"
    
      24        "nxserver-arch.patch")
    
      25source_i686=("http://url.muflone.com/nxclient-3.5.0-7.i386.tar.gz"
    
      26             "http://url.muflone.com/nxnode-3.5.0-9.i386.tar.gz"
    
      27             "http://url.muflone.com/nxserver-3.5.0-11.i386.tar.gz")
    
      28source_x86_64=("http://url.muflone.com/nxclient-3.5.0-7.x86_64.tar.gz"
    
      29               "http://url.muflone.com/nxnode-3.5.0-9.x86_64.tar.gz"
    
      30               "http://url.muflone.com/nxserver-3.5.0-11.x86_64.tar.gz")
    
      31sha256sums=('SKIP'
    
      32            '5ffb4b9981b305ed1dbd2cc24589607d585ece95f8739d84026e05c6909e9a7a'
    
      33            '7e284776f876b5a65a478b7dca5e056284c6dcf31d070a970e2898de94df1100'
    
      34            'e32ff6b79c5bace2faf63bf9e333f66b3c283e5641c08abaf55ffef5be83a997'
    
      35            '7efdf6c07dbb56b76608729849af866b3df60f9533e0e162b1bf2f2df270a5b2')
    
      36sha256sums_i686=('3e4c5882f07ea408b3cf0e96aba6a06745a8838cccead8914ef2c96ba6a19953'
    
      37                 '93310cd78617ca3619fbf093d6760c00459367ebf824ec643c1c5f20202d8488'
    
      38                 '860a5de07e247e38d951f77b87f4dae3eb338120d768f2098df6332e63910074')
    
      39sha256sums_x86_64=('e1037f3bd5ccfaa376a6e6dca1c52d666bfd7ea813d3971e85a086e541141e71'
    
      40                   '555ed1d18280825075c617effec2cfdc83fd2d8be189b08b09288abefbe86238'
    
      41                   '05b462bf6b888dbdd22246a521a0b6ed18ba5d55de673a53c5ae9d9c6dd68c63')
    
      42
    
      43prepare() {
    
      44  # Prepare license file
    
      45  html2text --ignore-links --ignore-images --ignore-emphasis --body-width=80 < \
    
      46    license.html | sed -n '/End-User License Agreement/,/for any updates/p' > LICENSE
    
      47  # Patch nxnode and nxserver launchers
    
      48  patch -Np2 -i "nxnode-arch.patch"
    
      49  patch -Np2 -i "nxserver-arch.patch"
    
      50  # Fix configuration files
    
      51  cd "NX/etc"
    
      52  install "node-debian.cfg.sample" "node-arch.cfg.sample"
    
      53  sed -i 's,^CommandFuser =.*$,CommandFuser = "/usr/bin/fuser",' "node-arch.cfg.sample"
    
      54  install "server-debian.cfg.sample" "server-arch.cfg.sample"
    
      55  sed -i 's/^#SSHAuthorizedKeys = .*$/SSHAuthorizedKeys = "authorized_keys"/' "server-arch.cfg.sample"
    
      56}
    
      57
    
      58package() {
    
      59  # Install license
    
      60  install -m 755 -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      61  install -m 644 -t "${pkgdir}/usr/share/licenses/${pkgname}" LICENSE
    
      62  # Install systemd services
    
      63  install -m 755 -d "${pkgdir}/usr/lib/systemd/system"
    
      64  install -m 644 -t "${pkgdir}/usr/lib/systemd/system" "nxsensor.service" "nxserver.service"
    
      65  # Install program files
    
      66  install -m 755 -d "${pkgdir}/usr/NX"
    
      67  cp -a "${srcdir}/NX" "${pkgdir}/usr/"
    
      68  # Install launchers
    
      69  install -m 755 -d "${pkgdir}/usr/bin/"
    
      70  ln -s -t "${pkgdir}/usr/bin/" /usr/NX/bin/{nxclient,nxkill,nxnode,nxprint,nxserver}
    
      71}
    
      72
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2