puppyclicker-appimage

MEDIUM

maintainer ninetailedtori 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a non-whitelisted, project-specific CDN domain (boundfire.com), which is an unverifiable executable artifact; if the host were compromised or the download redirected, it could deliver malicious code, though the use of multiple strong checksums mitigates but does not eliminate the risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt AppImage from a non-whitelisted, project-specific CDN domain (boundfire.com), which is an unverifiable executable artifact; if the host were compromised or the download redirected, it could deliver malicious code, though the use of multiple strong checksums mitigates but does not eliminate the risk.

PKGBUILD

      1#!/usr/bin/env bash
    
      2# shellcheck disable=SC2034,SC2086,SC2128,SC2148,SC2154,SC2164,SC2291
    
      3
    
      4# Maintainer: Toria <ninetailedtori@uwu.gal>
    
      5
    
      6_pkgname='puppyclicker'
    
      7pkgname="${_pkgname}-appimage"
    
      8pkgver=3.5.8
    
      9pkgrel=3
    
      10pkgdesc='Click your puppies from anywhere. (By Boundfire.)'
    
      11url="https://${_pkgname}.app/"
    
      12arch=(
    
      13  'x86_64'
    
      14  'aarch64'
    
      15)
    
      16license=('unknown')
    
      17_cdn_url="https://cdn${_pkgname}.boundfire.com/build"
    
      18makedepends=(
    
      19  'grep'
    
      20  'asar'
    
      21  'appimagetool-bin'
    
      22)
    
      23options=(!strip)
    
      24source_x86_64=("${_pkgname}.AppImage::${_cdn_url}/linux.AppImage")
    
      25source_aarch64=("${_pkgname}.AppImage::${_cdn_url}/linux-arm64.AppImage")
    
      26
    
      27sha256sums_x86_64=('f5598b9c7cbd16ad79c199802f9b046d9ec225b1d7c61ada219c865b626a4574')
    
      28sha256sums_aarch64=('f5598b9c7cbd16ad79c199802f9b046d9ec225b1d7c61ada219c865b626a4574')
    
      29sha384sums_x86_64=('ab8784603786b33a079c30fe3fd31e1731ec9c96588f545c1c6b898216e928b23d58c935b2e2de78e24010fc5368c0de')
    
      30sha384sums_aarch64=('ab8784603786b33a079c30fe3fd31e1731ec9c96588f545c1c6b898216e928b23d58c935b2e2de78e24010fc5368c0de')
    
      31sha512sums_x86_64=('1eb9e7dd960e3ff0031a8d38be40b7eaea95c1635454b3065d2ad0920eff3d10a31e3bd431ce623ad0cf4c611c06ba0bb4d897eaa49bdc23f55b1ead81fe69dd')
    
      32sha512sums_aarch64=('1eb9e7dd960e3ff0031a8d38be40b7eaea95c1635454b3065d2ad0920eff3d10a31e3bd431ce623ad0cf4c611c06ba0bb4d897eaa49bdc23f55b1ead81fe69dd')
    
      33b2sums_x86_64=('3f13ef8551658b456c5938aff4853947a560b680863d52dd7787faa7169f72f162b2a8f1009ddf26588715d84e0f4a86c4e5f7fbc12bde58ac43bf2338698a33')
    
      34b2sums_aarch64=('3f13ef8551658b456c5938aff4853947a560b680863d52dd7787faa7169f72f162b2a8f1009ddf26588715d84e0f4a86c4e5f7fbc12bde58ac43bf2338698a33')
    
      35
    
      36prepare() {
    
      37  cd "${srcdir}"
    
      38
    
      39  chmod                    755                "${_pkgname}.AppImage"
    
      40  "./${_pkgname}.AppImage" --appimage-extract &>/dev/null
    
      41
    
      42  cp  -t "./" "squashfs-root/${_pkgname}.desktop"
    
      43  sed -i 's|^Exec=AppRun.*|Exec=/usr/bin/puppyclicker %U|' "${_pkgname}.desktop"
    
      44
    
      45  # Patch the launcher to ignore hcaptcha and fix the api endpoint to the new structure.
    
      46  # cd           'squashfs-root/resources'
    
      47  # asar extract 'app.asar'                                        'app-extracted'
    
      48  # (
    
      49  #   cd app-extracted/app/_expo/static/js/web/
    
      50  #   sed -i \
    
      51  #     -e 's/const c=!0;/const c=!1;/g' \
    
      52  #     index-*.js
    
      53  # )
    
      54
    
      55  # Repack
    
      56  # asar pack    'app-extracted'                                   'app.asar'
    
      57  # rm -rf       'app-extracted'
    
      58  # cd           '../..'
    
      59  # appimagetool 'squashfs-root'                                   'puppyclicker'
    
      60  cp "${_pkgname}.AppImage" "${_pkgname}"
    
      61}
    
      62
    
      63pkgver() {
    
      64  cd       "${srcdir}"
    
      65
    
      66  grep -oP 'X-AppImage-Version=\K.*' "${_pkgname}.desktop"
    
      67}
    
      68
    
      69package() {
    
      70  cd             "${srcdir}"
    
      71
    
      72  install -Dm755 "${_pkgname}"         "${pkgdir}/usr/bin/${_pkgname}"
    
      73  install -Dm644 "${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      74  (
    
      75    cd   'squashfs-root/usr/share/icons/hicolor' && \
    
      76    find . -type f -exec install -Dm644 {} "${pkgdir}/usr/share/icons/hicolor/{}" \;
    
      77  )
    
      78
    
      79  # TODO: ADD WHEN THERE'S A LICENSE FILE TO ADD.
    
      80  # mkdir   -p     "${pkgdir}/usr/share/${pkgname}"
    
      81  # install -Dm644 "LICENSE" "${pkgdir}/usr/share/${pkgname}/LICENSE"
    
      82}
    
      83

Changes since previous scan

--- PKGBUILD @ 2026-10-15 03:10
+++ PKGBUILD @ 2026-10-17 00:21
@@ -6,7 +6,7 @@
 _pkgname='puppyclicker'
 pkgname="${_pkgname}-appimage"
 pkgver=3.5.8
-pkgrel=1
+pkgrel=3
 pkgdesc='Click your puppies from anywhere. (By Boundfire.)'
 url="https://${_pkgname}.app/"
 arch=(
@@ -17,34 +17,60 @@
 _cdn_url="https://cdn${_pkgname}.boundfire.com/build"
 makedepends=(
   'grep'
+  'asar'
+  'appimagetool-bin'
 )
 options=(!strip)
-source_x86_64=("${_pkgname}::${_cdn_url}/linux.AppImage")
+source_x86_64=("${_pkgname}.AppImage::${_cdn_url}/linux.AppImage")
+source_aarch64=("${_pkgname}.AppImage::${_cdn_url}/linux-arm64.AppImage")
+
+sha256sums_x86_64=('f5598b9c7cbd16ad79c199802f9b046d9ec225b1d7c61ada219c865b626a4574')
+sha256sums_aarch64=('f5598b9c7cbd16ad79c199802f9b046d9ec225b1d7c61ada219c865b626a4574')
+sha384sums_x86_64=('ab8784603786b33a079c30fe3fd31e1731ec9c96588f545c1c6b898216e928b23d58c935b2e2de78e24010fc5368c0de')
+sha384sums_aarch64=('ab8784603786b33a079c30fe3fd31e1731ec9c96588f545c1c6b898216e928b23d58c935b2e2de78e24010fc5368c0de')
+sha512sums_x86_64=('1eb9e7dd960e3ff0031a8d38be40b7eaea95c1635454b3065d2ad0920eff3d10a31e3bd431ce623ad0cf4c611c06ba0bb4d897eaa49bdc23f55b1ead81fe69dd')
+sha512sums_aarch64=('1eb9e7dd960e3ff0031a8d38be40b7eaea95c1635454b3065d2ad0920eff3d10a31e3bd431ce623ad0cf4c611c06ba0bb4d897eaa49bdc23f55b1ead81fe69dd')
 b2sums_x86_64=('3f13ef8551658b456c5938aff4853947a560b680863d52dd7787faa7169f72f162b2a8f1009ddf26588715d84e0f4a86c4e5f7fbc12bde58ac43bf2338698a33')
-sha512sums_x86_64=('1eb9e7dd960e3ff0031a8d38be40b7eaea95c1635454b3065d2ad0920eff3d10a31e3bd431ce623ad0cf4c611c06ba0bb4d897eaa49bdc23f55b1ead81fe69dd')
-sha384sums_x86_64=('ab8784603786b33a079c30fe3fd31e1731ec9c96588f545c1c6b898216e928b23d58c935b2e2de78e24010fc5368c0de')
-sha256sums_x86_64=('f5598b9c7cbd16ad79c199802f9b046d9ec225b1d7c61ada219c865b626a4574')
+b2sums_aarch64=('3f13ef8551658b456c5938aff4853947a560b680863d52dd7787faa7169f72f162b2a8f1009ddf26588715d84e0f4a86c4e5f7fbc12bde58ac43bf2338698a33')
 
-source_aarch64=("${_pkgname}::${_cdn_url}/linux-arm64.AppImage")
-b2sums_aarch64=('3f13ef8551658b456c5938aff4853947a560b680863d52dd7787faa7169f72f162b2a8f1009ddf26588715d84e0f4a86c4e5f7fbc12bde58ac43bf2338698a33')
-sha512sums_aarch64=('1eb9e7dd960e3ff0031a8d38be40b7eaea95c1635454b3065d2ad0920eff3d10a31e3bd431ce623ad0cf4c611c06ba0bb4d897eaa49bdc23f55b1ead81fe69dd')
-sha384sums_aarch64=('ab8784603786b33a079c30fe3fd31e1731ec9c96588f545c1c6b898216e928b23d58c935b2e2de78e24010fc5368c0de')
-sha256sums_aarch64=('f5598b9c7cbd16ad79c199802f9b046d9ec225b1d7c61ada219c865b626a4574')
+prepare() {
+  cd "${srcdir}"
+
+  chmod                    755                "${_pkgname}.AppImage"
+  "./${_pkgname}.AppImage" --appimage-extract &>/dev/null
+
+  cp  -t "./" "squashfs-root/${_pkgname}.desktop"
+  sed -i 's|^Exec=AppRun.*|Exec=/usr/bin/puppyclicker %U|' "${_pkgname}.desktop"
+
+  # Patch the launcher to ignore hcaptcha and fix the api endpoint to the new structure.
+  # cd           'squashfs-root/resources'
+  # asar extract 'app.asar'                                        'app-extracted'
+  # (
+  #   cd app-extracted/app/_expo/static/js/web/
+  #   sed -i \
+  #     -e 's/const c=!0;/const c=!1;/g' \
+  #     index-*.js
+  # )
+
+  # Repack
+  # asar pack    'app-extracted'                                   'app.asar'
+  # rm -rf       'app-extracted'
+  # cd           '../..'
+  # appimagetool 'squashfs-root'                                   'puppyclicker'
+  cp "${_pkgname}.AppImage" "${_pkgname}"
+}
 
 pkgver() {
-  cd "${srcdir}"
+  cd       "${srcdir}"
 
-  chmod           755                "${_pkgname}"
-  "./${_pkgname}" --appimage-extract &>/dev/null
-
-  grep -oP 'X-AppImage-Version=\K.*' "squashfs-root/${_pkgname}.desktop"
+  grep -oP 'X-AppImage-Version=\K.*' "${_pkgname}.desktop"
 }
 
 package() {
-  cd "${srcdir}"
+  cd             "${srcdir}"
 
-  install -Dm755 "${_pkgname}"                       "${pkgdir}/usr/bin/${_pkgname}"
-  install -Dm644 "squashfs-root/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
+  install -Dm755 "${_pkgname}"         "${pkgdir}/usr/bin/${_pkgname}"
+  install -Dm644 "${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
   (
     cd   'squashfs-root/usr/share/icons/hicolor' && \
     find . -type f -exec install -Dm644 {} "${pkgdir}/usr/share/icons/hicolor/{}" \;
@@ -52,6 +78,6 @@
 
   # TODO: ADD WHEN THERE'S A LICENSE FILE TO ADD.
   # mkdir   -p     "${pkgdir}/usr/share/${pkgname}"
-  # install -Dm644 "LICENSE"                                     "${pkgdir}/usr/share/${pkgname}/LICENSE"
+  # install -Dm644 "LICENSE" "${pkgdir}/usr/share/${pkgname}/LICENSE"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 19:13:05	Medium	2
2026-10-15 05:10:54	Medium	2
2026-10-15 03:10:23	Medium	2
2026-10-15 01:21:20	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 23:21:11	Medium	2