qqmusic-electron-patched

MEDIUM

maintainer Yueyuri 0 votes scanned 2026-08-20 17:11:42.006138

View on AUR

Why flagged

The package installs a prebuilt patched Electron app from a GitHub release without a clear upstream source or build-from-source process, posing a supply-chain risk if the patched binary were malicious.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt patched Electron app from a GitHub release without a clear upstream source or build-from-source process, posing a supply-chain risk if the patched binary were malicious.

PKGBUILD

      1# Maintainer: Yuzuki <lxf74663@gmail.com>
    
      2# Contributor: Zhong Lufan <lufanzhong@gmail.com>
    
      3
    
      4pkgname=qqmusic-electron-patched
    
      5_pkgname=qqmusic
    
      6pkgver=1.1.8
    
      7pkgrel=1
    
      8pkgdesc="Tencent QQMusic"
    
      9arch=('any')
    
      10url="https://github.com/Viemean/qqmusiclinux"
    
      11license=('CC0-1.0')
    
      12_electron=electron43
    
      13depends=(${_electron})
    
      14makedepends=('p7zip')
    
      15provides=("${_pkgname}" "qqmusic-electron")
    
      16conflicts=('qqmusic' 'qqmusic-electron' 'qqmusic-bin')
    
      17source=(
    
      18    "${_pkgname}-${pkgver}-patched.7z::https://github.com/Viemean/qqmusiclinux/releases/download/v${pkgver}/${_pkgname}-${pkgver}-patched.7z"
    
      19    "${_pkgname}.desktop"
    
      20    "${_pkgname}.sh"
    
      21    "logo.png"
    
      22)
    
      23sha512sums=('1b3d608c4041394ed32c53d3927477e0a50048ed7a83d68f9944d774db16e42ed364d4c93eba76dbf57716dc77835728dd9429b38d282e8bb7d37005b9d05cd6'
    
      24            'a872d410a02700b66ae9c55ee10a59bc6831caf403f3e62a96b7baa3ea39a8d239a1b829d2b13db4947b97daa9b9eb588deeea05ed125a6ac6892f43d6aa300f'
    
      25            'e152bd02f7148cf24411c6420a19ed597841dc61a49c67fd3774dad246bc874b7ecdb29fca6376550845ac27e67fad7722f8647b40f10586dc28d926fa2b5bab'
    
      26            '1f49450952fc7be0654a046c73cd55b738b940a910eb83d0de073f8c5077b550865f7b74e8171ea4b34dd160a7ffdc616ab9dab14d2227db6e4e5ef9ce54c700')
    
      27
    
      28prepare() {
    
      29    cd "${srcdir}"
    
      30    sed -i "s|__ELECTRON__|${_electron}|g" ${_pkgname}.sh
    
      31}
    
      32
    
      33package() {
    
      34    cd "${srcdir}"
    
      35    install -Dm755 ${_pkgname}.sh "${pkgdir}/usr/bin/qqmusic"
    
      36    install -Dm644 app.asar "${pkgdir}/usr/lib/qqmusic/app.asar"
    
      37    install -Dm644 ${_pkgname}.desktop "${pkgdir}/usr/share/applications/qqmusic.desktop"
    
      38    install -Dm644 logo.png "${pkgdir}/usr/share/pixmaps/qqmusic.png"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 17:11:42	Medium	2