purevpn-gui

maintainer 1nikolas · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from apps.purevpn-tools.com, which is a subdomain of purevpn-tools.com rather than the canonical purevpn.com domain. While this could be a legitimate CDN/distribution host operated by PureVPN, it is not the official purevpn.com domain and cannot be independently verified as such without external research. The .deb contains a prebuilt Electron/Chromium-based VPN application binary that is extracted and installed directly. Additionally, a C source file (dpkg-query.c) is compiled and installed into /opt/PureVPN/ as a fake dpkg-query shim — this compiled binary runs with whatever privileges the VPN app uses. The sha512sums are present and pin the downloaded artifacts, which mitigates substitution risk somewhat, but the checksums themselves are only as trustworthy as the PKGBUILD maintainer. The combination of: (1) a prebuilt closed-source binary from a non-canonical domain, (2) a compiled C shim injected into the app directory, and (3) a VPN application that by nature handles network traffic and credentials, constitutes a genuine medium-severity supply-chain concern. Not clearly malicious, but the unofficial host and binary execution pattern warrant the medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_x86_64=("https://apps.purevpn-tools.com/cross-platform/linux-gui/${pkgver}/PureVPN_amd64.deb?${pkgver}"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from apps.purevpn-tools.com, which is a subdomain of purevpn-tools.com rather than the canonical purevpn.com domain. While this could be a legitimate CDN/distribution host operated by PureVPN, it is not the official purevpn.com domain and cannot be independently verified as such without external research. The .deb contains a prebuilt Electron/Chromium-based VPN application binary that is extracted and installed directly. Additionally, a C source file (dpkg-query.c) is compiled and installed into /opt/PureVPN/ as a fake dpkg-query shim — this compiled binary runs with whatever privileges the VPN app uses. The sha512sums are present and pin the downloaded artifacts, which mitigates substitution risk somewhat, but the checksums themselves are only as trustworthy as the PKGBUILD maintainer. The combination of: (1) a prebuilt closed-source binary from a non-canonical domain, (2) a compiled C shim injected into the app directory, and (3) a VPN application that by nature handles network traffic and credentials, constitutes a genuine medium-severity supply-chain concern. Not clearly malicious, but the unofficial host and binary execution pattern warrant the medium rating.

PKGBUILD

1 offending line(s) highlighted

      1# Generated by debtap
    
      2# Maintainer: 1nikolas
    
      3# Contributor: 1nikolas
    
      4pkgname=purevpn-gui
    
      5pkgver=2.11.0
    
      6pkgrel=1
    
      7pkgdesc='PureVPN Linux Application (GUI)'
    
      8arch=('x86_64')
    
      9url='https://www.purevpn.com/download/linux-vpn'
    
      10license=('Custom')
    
      11depends=('gtk3' 'libnotify' 'nss' 'libxtst' 'xdg-utils' 'at-spi2-atk' 'util-linux-libs' 'libsecret' 'openresolv' 'openvpn' 'wireguard-tools' 'net-tools' 'coreutils')
    
      12makedepends=('gcc')
    
      13optdepends=('libappindicator-gtk3')
    
      14options=('!strip' '!emptydirs')
    
      15install=${pkgname}.install
    
      16source_x86_64=("https://apps.purevpn-tools.com/cross-platform/linux-gui/${pkgver}/PureVPN_amd64.deb?${pkgver}"
    
      17               'dpkg-query.c'
    
      18               'purevpn.desktop'
    
      19               'purevpn')
    
      20sha512sums_x86_64=('85fa461ea065ee0f0f371b6969b4a6f368235285723ead189604dbf98175a0b6b3226b1a3ebdca61605fb44951b9a38c42b8fcb41b597c8f63a9b76f6d2d4986'
    
      21                   '23011a501725a3980441007fc579f323a9ac50821f079b6ca555ce4c2d500ada6bfa861169456ccd0a61ff4a4f4fc967358f0b25c0a082c64b169f502435287a'
    
      22                   '6d91106dee8fc9a61c5f111acb2153bbfc7212ee6feda7a744244e0da49f5b244f4a39853659c4834f9ab91683bcc4cf3eedbf64eae38828d4327c899b3f293c'
    
      23                   '20ca17878747f6c08bb8506a9e945f3475860b38a0be54e35155d920431a7250c6626b90d538d6823c52b5a56f1115ffafc2628e326326d9bc853bcdd169033a')
    
      24
    
      25package(){
    
      26
    
      27	# Extract package data
    
      28	tar -xJ -f data.tar.xz -C "${pkgdir}"
    
      29
    
      30	install -D -m644 "${pkgdir}/opt/PureVPN/LICENSES.chromium.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      31
    
      32	# Compile fake dpkg-query
    
      33	gcc dpkg-query.c -o "${pkgdir}/opt/PureVPN/dpkg-query"
    
      34
    
      35	# Install desktop
    
      36	install -D -m664 purevpn.desktop "${pkgdir}/usr/share/applications/purevpn.desktop"
    
      37
    
      38	# Install /usr/bin bash shortcut
    
      39	install -D -m755 purevpn "${pkgdir}/usr/bin/purevpn"
    
      40
    
      41
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2