qqmusic-electron
MEDIUM
maintainer sukanka
11 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt ASAR archive (a bundled JavaScript application) from a non-standard, third-party host (q.askk.cc) which is not Tencent's official domain, creating a supply-chain risk where the executable code could be silently replaced.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
"qqmusic_${pkgver}-${pkgrel}.asar::https://q.askk.cc/qqmusic_${pkgver}-1.asar"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt ASAR archive (a bundled JavaScript application) from a non-standard, third-party host (q.askk.cc) which is not Tencent's official domain, creating a supply-chain risk where the executable code could be silently replaced.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Zhong Lufan <lufanzhong@gmail.com>
2
3
pkgname=qqmusic-electron
4
_pkgname=qqmusic
5
pkgver=1.1.8
6
pkgrel=6
7
pkgdesc="Tencent QQMusic, Run with system Electron."
8
arch=('any')
9
url="https://y.qq.com/"
10
license=('CC0-1.0')
11
_electron=electron44
12
depends=(${_electron})
13
makedepends=('asar')
14
provides=("$_pkgname")
15
conflicts=('qqmusic-bin')
16
source=(
17
"qqmusic_${pkgver}-${pkgrel}.asar::https://q.askk.cc/qqmusic_${pkgver}-1.asar"
18
"${_pkgname}.desktop"
19
"${_pkgname}.sh"
20
)
21
sha512sums=('293c88c09e2aef36129f9b557e0be20c9f0bde67ac6b0d39007194c3f09cf4759e0786264ab0822f8131cf1d8d1aafccaee1d0cf05f38de16972cd53b4cc7b13'
22
'a872d410a02700b66ae9c55ee10a59bc6831caf403f3e62a96b7baa3ea39a8d239a1b829d2b13db4947b97daa9b9eb588deeea05ed125a6ac6892f43d6aa300f'
23
'609633590f7b00afc9368c0ff7f63d1fcce77e3642a6085514334b6f26d96be1f8f1243c1ddae62b1ecb03cf8c25779446b74af961276311bd178473370afddc')
24
25
prepare() {
26
cd "${srcdir}"
27
asar ef qqmusic_${pkgver}-${pkgrel}.asar logo.png
28
sed -i "s|__ELECTRON__|${_electron}|g" ${_pkgname}.sh
29
}
30
31
package() {
32
cd "${srcdir}"
33
install -Dm755 ${_pkgname}.sh "${pkgdir}/usr/bin/qqmusic"
34
install -Dm644 qqmusic_${pkgver}-${pkgrel}.asar "${pkgdir}/usr/lib/qqmusic/app.asar"
35
install -Dm644 ${_pkgname}.desktop "${pkgdir}/usr/share/applications/qqmusic.desktop"
36
install -Dm644 logo.png "${pkgdir}/usr/share/pixmaps/qqmusic.png"
37
}
38
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |