sendanywhere

maintainer nailington · 16 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt .deb from update.send-anywhere.com (the vendor's own update server) and extracts a native binary (paprika.node) that is installed and executed at runtime via Electron. The host appears to be the official vendor update endpoint for Send Anywhere, not a personal or random host, which reduces concern somewhat. However, the URL always fetches 'sendanywhere_latest_amd64.deb' (a mutable 'latest' URL), meaning the sha512sum pinned in the PKGBUILD will break whenever upstream updates, and any compromise of the vendor's update server would deliver arbitrary code. The paprika.node native addon is executed with full system privileges. This is a legitimate medium-risk supply-chain concern: a prebuilt native binary from a vendor update server with a mutable URL, though the checksum does provide some protection at the time of packaging. Not high because there is no evidence of malice, obfuscation, or active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("${pkgname}-${pkgver}.deb::https://update.send-anywhere.com/linux_downloads/sendanywhere_latest_amd64.deb" "LICENSE")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt .deb from update.send-anywhere.com (the vendor's own update server) and extracts a native binary (paprika.node) that is installed and executed at runtime via Electron. The host appears to be the official vendor update endpoint for Send Anywhere, not a personal or random host, which reduces concern somewhat. However, the URL always fetches 'sendanywhere_latest_amd64.deb' (a mutable 'latest' URL), meaning the sha512sum pinned in the PKGBUILD will break whenever upstream updates, and any compromise of the vendor's update server would deliver arbitrary code. The paprika.node native addon is executed with full system privileges. This is a legitimate medium-risk supply-chain concern: a prebuilt native binary from a vendor update server with a mutable URL, though the checksum does provide some protection at the time of packaging. Not high because there is no evidence of malice, obfuscation, or active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Ye Shu <shuye02@outlook.com>
    
      2# Contributor: Aaron Fischer <mail@aaron-fischer.net>
    
      3# Contributor: Ashwin Vishnu <ashuwish+arch at gmail dot com>
    
      4
    
      5pkgname=sendanywhere
    
      6pkgver=24.3.8
    
      7pkgrel=1
    
      8arch=('x86_64')
    
      9
    
      10pkgdesc="Send Anywhere is a multi-platform file sharing service where users can directly share digital content in real time."
    
      11url="http://send-anywhere.com"
    
      12license=('custom')
    
      13depends=('electron8')
    
      14makedepends=('asar')
    
      15
    
      16source=("${pkgname}-${pkgver}.deb::https://update.send-anywhere.com/linux_downloads/sendanywhere_latest_amd64.deb" "LICENSE")
    
      17sha512sums=('1efd97e87385eced4ff7ee6ab6041665237ec2e160307b0bd326f5d65ca9c07f89d0c903addc4b84edae0e3f61bb0597ad70d0440a47981700665280ae964850'
    
      18            'aeb97a12f246d78cbf202354148b429a037997d68087bceed5d5ce5036443d779c2535138b54347579ddf05994a61b9333913f9261733f367d02e0e9cf7d0b5e')
    
      19# If validity check fails, please leave a comment to remind me to update the package version
    
      20
    
      21package(){
    
      22    # Extract the data package
    
      23    tar -xf data.tar.xz
    
      24    cd $srcdir/opt/SendAnywhere
    
      25
    
      26    mkdir -p $pkgdir/usr/lib/$pkgname
    
      27
    
      28    # HACKS FOR SYSTEM ELECTRON
    
      29    asar e resources/app.asar resources/app
    
      30    sed -i "s|,\"paprika.node\"|,\"/usr/lib/$pkgname/paprika.node\"|" resources/app/src/main/main.prod.js
    
      31
    
      32    # Copy Relevanat data
    
      33    cp -r resources/app  $pkgdir/usr/lib/$pkgname/
    
      34    cp paprika.node $pkgdir/usr/lib/$pkgname/
    
      35
    
      36    cd $srcdir
    
      37
    
      38    # Create starter script
    
      39    echo "#!/bin/sh" >> $pkgname
    
      40    echo "exec electron8 /usr/lib/$pkgname/app \$@" >> $pkgname
    
      41    mkdir -p $pkgdir/usr/bin
    
      42    install -Dm 755 $pkgname $pkgdir/usr/bin/$pkgname
    
      43
    
      44    # Install .desktop and icon
    
      45    cp -r usr/share $pkgdir/usr/
    
      46    sed -i "s|Exec=.*|Exec=/usr/bin/$pkgname|" $pkgdir/usr/share/applications/SendAnywhere.desktop
    
      47    sed -i "s|StartupWMClass=.*|StartupWMClass=Send Anywhere|" $pkgdir/usr/share/applications/SendAnywhere.desktop
    
      48
    
      49    # Add licenses
    
      50    install -Dm644 $srcdir/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2