phoenix-launcher

maintainer RezaNajafian · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage (an executable binary bundle) from dl.phoenixclient.ir, which is the project's own distribution subdomain rather than a well-known forge like GitHub releases. The critical issue is that all three sources use sha256sums='SKIP', meaning there is zero integrity verification on the downloaded executable. An AppImage is a self-contained executable that runs arbitrary code, so a compromised or silently swapped binary on that host would directly result in code execution on the user's system. While the host appears to be the official vendor's CDN (matching the project URL phoenixclient.ir), the lack of any checksum makes this a genuine supply-chain risk: the binary could be replaced at any time without detection. This is a real medium-severity concern — not clearly malicious, but an executed binary from a non-major-forge host with no integrity check.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://dl.phoenixclient.ir/lnchr/Phoenix-Launcher_${pkgver}_amd64.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt AppImage (an executable binary bundle) from dl.phoenixclient.ir, which is the project's own distribution subdomain rather than a well-known forge like GitHub releases. The critical issue is that all three sources use sha256sums='SKIP', meaning there is zero integrity verification on the downloaded executable. An AppImage is a self-contained executable that runs arbitrary code, so a compromised or silently swapped binary on that host would directly result in code execution on the user's system. While the host appears to be the official vendor's CDN (matching the project URL phoenixclient.ir), the lack of any checksum makes this a genuine supply-chain risk: the binary could be replaced at any time without detection. This is a real medium-severity concern — not clearly malicious, but an executed binary from a non-major-forge host with no integrity check.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: xii69 <xii69@yahoo.com>
    
      2pkgname=phoenix-launcher
    
      3_pkgname=phoenix-launcher
    
      4pkgver=1.3.2
    
      5pkgrel=1
    
      6pkgdesc="Phoenix Launcher"
    
      7arch=('x86_64')
    
      8url="https://phoenixclient.ir"
    
      9license=('custom')
    
      10depends=('fuse2' 'xorg-xrandr')
    
      11options=(!strip !debug)
    
      12source=("https://dl.phoenixclient.ir/lnchr/Phoenix-Launcher_${pkgver}_amd64.AppImage"
    
      13        "phoenix-launcher.desktop"
    
      14        "phoenix-launcher.png")
    
      15sha256sums=('SKIP' 'SKIP' 'SKIP')
    
      16
    
      17package() {
    
      18    # AppImage
    
      19    install -Dm755 \
    
      20        "${srcdir}/Phoenix-Launcher_${pkgver}_amd64.AppImage" \
    
      21        "${pkgdir}/opt/${_pkgname}/${_pkgname}.AppImage"
    
      22
    
      23    # Desktop file
    
      24    install -Dm644 \
    
      25        "${srcdir}/phoenix-launcher.desktop" \
    
      26        "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      27
    
      28    # Icon
    
      29    install -Dm644 \
    
      30        "${srcdir}/phoenix-launcher.png" \
    
      31        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png"
    
      32
    
      33    # Symlink executable
    
      34    install -dm755 "${pkgdir}/usr/bin"
    
      35    ln -s \
    
      36        "/opt/${_pkgname}/${_pkgname}.AppImage" \
    
      37        "${pkgdir}/usr/bin/${_pkgname}"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2