sanguosha

maintainer yetist · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows installer (SGSOL_SetUp.exe) from olh5download.sanguosha.com, which is a subdomain of the official sanguosha.com game publisher domain — not a random personal host. The URL structure (olh5/wd/win/official/) and the versioned query parameter are consistent with an official CDN distribution endpoint. However, the package extracts an app.asar from inside the installer and installs it to be executed by electron13. An app.asar is JavaScript code that runs with Node.js/Electron privileges, meaning any malicious or tampered content in the asar would result in code execution. The sha256sum for the exe is pinned, which provides some integrity guarantee, but the source is still a binary blob from a Chinese game publisher's CDN with no reproducibility or source transparency. The combination of: (1) opaque binary installer as source, (2) extraction of executable JavaScript (asar) from it, and (3) execution via Electron constitutes a genuine medium-severity supply-chain concern — not because the host is clearly malicious, but because the installed artifact is executed code from an opaque binary with no upstream source. This is a legitimate MEDIUM, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("SGSOL_SetUp.exe::https://olh5download.sanguosha.com/olh5/wd/win/official/SGSOL_SetUp.exe?v=$pkgver"
PKGBUILD:13 'logo.webp::https://is3-ssl.mzstatic.com/image/thumb/Purple112/v4/49/64/fe/4964fe0b-0663-2998-b862-fce1c515ccbd/AppIcon-0-0-1x_U007emarketing-0-0-0-7-0-0-sRGB-0-0-0-GLES2_U002c0-512MB-85-220-0-0.png/230x0w.webp'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows installer (SGSOL_SetUp.exe) from olh5download.sanguosha.com, which is a subdomain of the official sanguosha.com game publisher domain — not a random personal host. The URL structure (olh5/wd/win/official/) and the versioned query parameter are consistent with an official CDN distribution endpoint. However, the package extracts an app.asar from inside the installer and installs it to be executed by electron13. An app.asar is JavaScript code that runs with Node.js/Electron privileges, meaning any malicious or tampered content in the asar would result in code execution. The sha256sum for the exe is pinned, which provides some integrity guarantee, but the source is still a binary blob from a Chinese game publisher's CDN with no reproducibility or source transparency. The combination of: (1) opaque binary installer as source, (2) extraction of executable JavaScript (asar) from it, and (3) execution via Electron constitutes a genuine medium-severity supply-chain concern — not because the host is clearly malicious, but because the installed artifact is executed code from an opaque binary with no upstream source. This is a legitimate MEDIUM, not a false positive.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Xiaotian Wu <yetist@gmail.com>
    
      2
    
      3pkgname=sanguosha
    
      4pkgver=1.0.8
    
      5pkgrel=2
    
      6pkgdesc="SanGuoSha Online (三国杀)"
    
      7url="https://www.sanguosha.com"
    
      8arch=('x86_64')
    
      9license=('custom')
    
      10depends=('electron13')
    
      11makedepends=('imagemagick')
    
      12source=("SGSOL_SetUp.exe::https://olh5download.sanguosha.com/olh5/wd/win/official/SGSOL_SetUp.exe?v=$pkgver"
    
      13	'logo.webp::https://is3-ssl.mzstatic.com/image/thumb/Purple112/v4/49/64/fe/4964fe0b-0663-2998-b862-fce1c515ccbd/AppIcon-0-0-1x_U007emarketing-0-0-0-7-0-0-sRGB-0-0-0-GLES2_U002c0-512MB-85-220-0-0.png/230x0w.webp'
    
      14        'sanguosha.desktop'
    
      15        'sanguosha.sh'
    
      16)
    
      17sha256sums=('e5ea9b748dc6bdf474b853eff812398e5725c51ff906b8ef66cfccad7acbc7ff'
    
      18            'bb04490fc7ebe363349c1a59ffa2e8f2a8005143a281fab73a7084134283c68e'
    
      19            '56ff518ef3ec397f2208b3e4dbcb4f67f533e7b0d6d121b24a5e974013925e58'
    
      20            'f68e3726f9adda9e84747f6983598efb85526ee086fabd9fd28fd24cbf08fa17')
    
      21noextract=('SGSOL_SetUp.exe')
    
      22
    
      23build() {
    
      24    7z x SGSOL_SetUp.exe '$PLUGINSDIR/app-64.7z'
    
      25    7z x './$PLUGINSDIR/app-64.7z' 'resources*'
    
      26    convert logo.webp icon.png
    
      27}
    
      28
    
      29package() {
    
      30    install -Dm644 resources/app.asar ${pkgdir}/usr/lib/${pkgname}/${pkgname}.asar
    
      31
    
      32    install -Dm755 sanguosha.sh ${pkgdir}/usr/bin/sanguosha
    
      33
    
      34    # Install desktop file
    
      35    install -Dm644 icon.png ${pkgdir}/usr/share/pixmaps/${pkgname}.png
    
      36    install -Dm644 sanguosha.desktop -t ${pkgdir}/usr/share/applications/
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2