onq

MEDIUM

maintainer visorcraft 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt ONNX Runtime binary from a non-standard, non-whitelisted host (cdn.pyke.io) which could be swapped by an unrelated party, constituting a supply-chain risk, though it is used as a library and not directly executed.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:63 npx --offline tauri build --no-bundle

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "onnxruntime-$_ortver-x86_64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@$_ortver/x86_64-unknown-linux-gnu.tar.lzma2"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt ONNX Runtime binary from a non-standard, non-whitelisted host (cdn.pyke.io) which could be swapped by an unrelated party, constituting a supply-chain risk, though it is used as a library and not directly executed.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: VisorCraft LLC <packages@visorcraft.com>
    
      2
    
      3pkgname=onq
    
      4pkgver=1.13.0
    
      5pkgrel=1
    
      6_ortver=1.24.2
    
      7pkgdesc='Search-oriented encrypted prompt vault'
    
      8arch=('x86_64')
    
      9url='https://github.com/visorcraft/onQ'
    
      10license=('GPL-3.0-only' 'MIT')
    
      11depends=(
    
      12  'cairo'
    
      13  'dbus'
    
      14  'gcc-libs'
    
      15  'gdk-pixbuf2'
    
      16  'glib2'
    
      17  'glibc'
    
      18  'gtk3'
    
      19  'hicolor-icon-theme'
    
      20  'libsoup3'
    
      21  'webkit2gtk-4.1'
    
      22)
    
      23makedepends=('cargo' 'npm' 'pkgconf')
    
      24conflicts=('onq-bin' 'onq-git')
    
      25options=('!lto')
    
      26source=(
    
      27  "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      28  'com.visorcraft.onq.desktop'
    
      29  "onnxruntime-$_ortver-x86_64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@$_ortver/x86_64-unknown-linux-gnu.tar.lzma2"
    
      30  "onnxruntime-$_ortver-LICENSE::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_ortver/LICENSE"
    
      31  "onnxruntime-$_ortver-ThirdPartyNotices.txt::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_ortver/ThirdPartyNotices.txt"
    
      32)
    
      33noextract=("onnxruntime-$_ortver-x86_64.tar.lzma2")
    
      34sha256sums=('708cdb5644995033e69b2bac8f2d8740f7dd025817192efa5b29e65cc4f78643'
    
      35            '5ac2f4c83de25d9c254e7ff8cba2e016935f174a0a2110e9be229168813978d3'
    
      36            'acc1cba79c337594ead1d88ca72516147aa60054c84217b53399a31caa5ba671'
    
      37            '2f07c72751aed99790b8a4869cf2311df85a860b22ded05fa22803587a48922c'
    
      38            '0e07b95f3a8d6230037707c5c4a2b554d12c4cb67369669ac255635528ffcee2')
    
      39
    
      40prepare() {
    
      41  cd "onQ-$pkgver"
    
      42  export CARGO_HOME="$srcdir/cargo"
    
      43  export npm_config_cache="$srcdir/npm-cache"
    
      44
    
      45  npm ci
    
      46  install -d "$srcdir/onnxruntime"
    
      47  xz --format=raw --lzma2=dict=64MiB -dc \
    
      48    "$srcdir/onnxruntime-$_ortver-x86_64.tar.lzma2" |
    
      49    bsdtar -xf - -C "$srcdir/onnxruntime"
    
      50  cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
    
      51}
    
      52
    
      53build() {
    
      54  cd "onQ-$pkgver"
    
      55  export CARGO_HOME="$srcdir/cargo"
    
      56  export CARGO_NET_OFFLINE=true
    
      57  export CARGO_PROFILE_RELEASE_LTO=false
    
      58  export npm_config_cache="$srcdir/npm-cache"
    
      59  export npm_config_offline=true
    
      60  export ORT_LIB_LOCATION="$srcdir/onnxruntime"
    
      61  export RUSTFLAGS="${RUSTFLAGS:-} --remap-path-prefix=$srcdir=/usr/src/debug/$pkgname-$pkgver"
    
      62
    
      63  npx --offline tauri build --no-bundle
    
      64}
    
      65
    
      66package() {
    
      67  cd "onQ-$pkgver"
    
      68
    
      69  install -Dm755 target/release/onQ "$pkgdir/usr/bin/onq"
    
      70  install -Dm644 "$srcdir/com.visorcraft.onq.desktop" \
    
      71    "$pkgdir/usr/share/applications/com.visorcraft.onq.desktop"
    
      72
    
      73  install -Dm644 crates/onq-app/icons/32x32.png \
    
      74    "$pkgdir/usr/share/icons/hicolor/32x32/apps/com.visorcraft.onq.png"
    
      75  install -Dm644 crates/onq-app/icons/64x64.png \
    
      76    "$pkgdir/usr/share/icons/hicolor/64x64/apps/com.visorcraft.onq.png"
    
      77  install -Dm644 crates/onq-app/icons/128x128.png \
    
      78    "$pkgdir/usr/share/icons/hicolor/128x128/apps/com.visorcraft.onq.png"
    
      79  install -Dm644 crates/onq-app/icons/128x128@2x.png \
    
      80    "$pkgdir/usr/share/icons/hicolor/256x256/apps/com.visorcraft.onq.png"
    
      81  install -Dm644 crates/onq-app/icons/icon.png \
    
      82    "$pkgdir/usr/share/icons/hicolor/512x512/apps/com.visorcraft.onq.png"
    
      83
    
      84  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      85  install -Dm644 "$srcdir/onnxruntime-$_ortver-LICENSE" \
    
      86    "$pkgdir/usr/share/licenses/$pkgname/ONNX-Runtime-LICENSE"
    
      87  install -Dm644 "$srcdir/onnxruntime-$_ortver-ThirdPartyNotices.txt" \
    
      88    "$pkgdir/usr/share/licenses/$pkgname/ONNX-Runtime-ThirdPartyNotices.txt"
    
      89  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      90}
    
      91

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: VisorCraft LLC <packages@visorcraft.com>
 
 pkgname=onq
-pkgver=1.12.0
+pkgver=1.13.0
 pkgrel=1
 _ortver=1.24.2
 pkgdesc='Search-oriented encrypted prompt vault'
@@ -31,7 +31,7 @@
   "onnxruntime-$_ortver-ThirdPartyNotices.txt::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_ortver/ThirdPartyNotices.txt"
 )
 noextract=("onnxruntime-$_ortver-x86_64.tar.lzma2")
-sha256sums=('f59e6b6c37b7607b6b1a92686b7b0f259f9a9a911093b6a5e7720d0de3cc5a6b'
+sha256sums=('708cdb5644995033e69b2bac8f2d8740f7dd025817192efa5b29e65cc4f78643'
             '5ac2f4c83de25d9c254e7ff8cba2e016935f174a0a2110e9be229168813978d3'
             'acc1cba79c337594ead1d88ca72516147aa60054c84217b53399a31caa5ba671'
             '2f07c72751aed99790b8a4869cf2311df85a860b22ded05fa22803587a48922c'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	3
2026-10-31 00:07:41	Medium	3
2026-10-30 00:29:30	Medium	3
2026-10-29 15:52:51	Medium	3
2026-10-29 00:13:55	Medium	3
2026-10-28 00:06:54	Medium	3
2026-10-27 00:23:28	Medium	3
2026-10-26 00:12:40	Medium	3
2026-10-25 00:20:48	Medium	3
2026-10-24 00:14:55	Medium	3
2026-10-23 00:02:19	Medium	3
2026-10-22 00:13:10	Medium	3
2026-10-21 00:12:50	Medium	3
2026-10-20 00:10:31	Medium	3
2026-10-19 00:03:55	Medium	3
2026-10-18 00:06:55	Medium	3
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 00:06:47	Medium	3