pictoblox-bin

maintainer dz-vadim · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from download.pictoblox.ai, which is the official vendor's download host for PictoBlox (made by STEMpedia/Agilo Technologies). The package extracts and installs the binary directly without any source build. The sha256sum is pinned, which mitigates casual tampering, but the risk profile is that of any prebuilt binary from a vendor: if the vendor's download server were compromised or the vendor itself were malicious, the fixed checksum would not help (it would just reflect the compromised binary). The icon is pulled from Google Play CDN (googleusercontent.com), which is a data-only PNG and poses no execution risk. This is a standard -bin AUR pattern for proprietary software distributed as a .deb, and pictoblox.ai is the legitimate vendor domain. The medium rating is appropriate: it's not clearly malicious, but it is an executed binary from a non-standard (vendor-specific) host with no source build, which is the canonical definition of a supply-chain concern at medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 "PictoBlox-Setup-${pkgver}.deb::https://download.pictoblox.ai/linux/PictoBlox-Setup-9.0.0.deb"
PKGBUILD:30 "pictoblox.png::https://play-lh.googleusercontent.com/lZzyTE3W9T9qNSdGG8Z3RA0GzlU5bX5hSYrcw6tfu2uK1Wf_9eqV-x-aJ0WMnVe1DQ"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from download.pictoblox.ai, which is the official vendor's download host for PictoBlox (made by STEMpedia/Agilo Technologies). The package extracts and installs the binary directly without any source build. The sha256sum is pinned, which mitigates casual tampering, but the risk profile is that of any prebuilt binary from a vendor: if the vendor's download server were compromised or the vendor itself were malicious, the fixed checksum would not help (it would just reflect the compromised binary). The icon is pulled from Google Play CDN (googleusercontent.com), which is a data-only PNG and poses no execution risk. This is a standard -bin AUR pattern for proprietary software distributed as a .deb, and pictoblox.ai is the legitimate vendor domain. The medium rating is appropriate: it's not clearly malicious, but it is an executed binary from a non-standard (vendor-specific) host with no source build, which is the canonical definition of a supply-chain concern at medium severity.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: dz-vadim <dziuba.vadym@gmail.com>
    
      2
    
      3pkgname=pictoblox-bin
    
      4pkgver=9.0.0
    
      5pkgrel=1
    
      6pkgdesc="PictoBlox STEM coding platform"
    
      7arch=('x86_64')
    
      8url="https://thestempedia.com/product/pictoblox/download-pictoblox/"
    
      9license=('unknown')
    
      10
    
      11depends=(
    
      12  'gtk3'
    
      13  'nss'
    
      14  'alsa-lib'
    
      15  'libxss'
    
      16  'libxtst'
    
      17  'libnotify'
    
      18  'libappindicator-gtk3'
    
      19  'libx11'
    
      20  'glib2'
    
      21)
    
      22
    
      23makedepends=('binutils')
    
      24options=('!strip')
    
      25install="${pkgname}.install"
    
      26
    
      27source=(
    
      28  "PictoBlox-Setup-${pkgver}.deb::https://download.pictoblox.ai/linux/PictoBlox-Setup-9.0.0.deb"
    
      29  "pictoblox.desktop"
    
      30  "pictoblox.png::https://play-lh.googleusercontent.com/lZzyTE3W9T9qNSdGG8Z3RA0GzlU5bX5hSYrcw6tfu2uK1Wf_9eqV-x-aJ0WMnVe1DQ"
    
      31)
    
      32
    
      33sha256sums=('9ee31657e96933633f0ced1ae77ccfcff9c038eb1715f96bc87fff35bde31ba9'
    
      34            '8d86488827d98b0a924c110d16331d37826f0a5f638f4cee0c2bdfd520c48ca6'
    
      35            '2f16f4f6d67785986b02219af30e16fac60857895f117d8d0ca97344b6160ffe')
    
      36
    
      37package() {
    
      38  cd "$srcdir"
    
      39
    
      40  ar x "PictoBlox-Setup-${pkgver}.deb"
    
      41  tar -xf data.tar.xz -C "$pkgdir"
    
      42
    
      43  install -Dm644 pictoblox.desktop \
    
      44    "$pkgdir/usr/share/applications/pictoblox.desktop"
    
      45
    
      46  install -Dm644 pictoblox.png \
    
      47    "$pkgdir/usr/share/pixmaps/pictoblox.png"
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2