shimo

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source_x86_64=("https://oas.shimonote.com/panther/${pkgname}/release/linux/x64/${pkgname}_v${pkgver}-release.6d12f71.shimo_linux-amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and installs a prebuilt Electron/Chromium-based binary .deb package from oas.shimonote.com. While this subdomain appears to be the vendor's own CDN/object storage (shimonote.com is the backend domain for shimo.im, a well-known Chinese collaborative office suite), it is not the canonical project homepage domain (shimo.im). The package installs a full Electron application binary directly into /opt, which executes with full user privileges. The sha512 checksums are present and pin specific builds, which mitigates substitution risk somewhat. However, the host is a non-canonical CDN subdomain rather than a verified official release channel (e.g., GitHub releases), and the binary is a closed-source Electron app with no source verification possible. This is a standard medium-risk pattern for prebuilt binary AUR packages from vendor-controlled but non-primary hosts — not clearly malicious, but a legitimate supply-chain concern if the CDN host were compromised. The sha512sums also appear to have incorrect lengths (127 hex chars instead of 128 for sha512), which could indicate a broken or truncated checksum, but this is likely a display artifact. Overall: medium severity, consistent with the prior rating.