qqmusic-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:18 "qqmusic_${pkgver}_amd64.deb::https://c.y.qq.com/cgi-bin/file_redirect.fcg?bid=dldir&file=ecosfile_plink%2Fmusic_clntupate%2Flinux%2Fother%2Fqqmusic_${pkgver}_amd64.deb&sign=${sign}"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from c.y.qq.com, which is Tencent's own CDN/redirect endpoint for QQ Music Linux downloads — this is the official upstream distribution channel for this proprietary application, not a random personal host. The URL uses a signed redirect (the 'sign' variable contains a hash token), which is consistent with Tencent's CDN signing mechanism. However, the package still qualifies as medium risk because: (1) it installs a prebuilt proprietary binary from a vendor CDN rather than building from source, which is the inherent supply-chain risk of all *-bin AUR packages; (2) the hex-patching of app.asar at install time modifies the shipped binary in ways that are opaque without reverse engineering; (3) the sha512sums are present and pin the downloaded artifacts, which mitigates substitution risk. The cheaper model's concern about the host is largely a false positive — c.y.qq.com is Tencent's legitimate distribution infrastructure — but the prebuilt-binary-from-vendor pattern is genuinely medium by AUR standards. No piracy or broken flags apply.