slimjet

maintainer ahmedmoselhi · 36 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from an untrusted host (slimjetbrowser.com) which is not the project's official domain, posing a supply-chain risk if the host is compromised.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:54 _ffmpegver="$(curl -s https://nwjs.io/versions.json | jq -r --arg v "${_slimjetver}" 'limit(1; .versions[] | select(.components.chromium | startswith($v))).version // empty')"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from an untrusted host (slimjetbrowser.com) which is not the project's official domain, posing a supply-chain risk if the host is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ahmedmoselhi
    
      2# Co-Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      3# Contributor: raininja <dandenkijin ad gmail dot com>
    
      4# Contributor: eagleeyetom <eagleeyetom at gmail dot com>
    
      5# Contributor: dalto <dalto at fastmail dot com>
    
      6pkgname=slimjet
    
      7_pkgname="flashpeak-${pkgname}"
    
      8pkgver=50.0.0.0
    
      9# curl -s https://nwjs.io/versions.json | jq -r 'limit(1; .versions[] | select(.components.chromium | startswith("137.")) | .version)'
    
      10# strings src/opt/slimjet/slimjet | grep -Eo '^Chrome/([0-9]+(\.[0-9]+)+)' | head -n 1
    
      11_libffmpegver=0.107.0
    
      12pkgrel=1
    
      13pkgdesc="Fast, smart and powerful browser based on Blink.(Prebuilt version)"
    
      14arch=('x86_64')
    
      15url="https://www.slimjet.com"
    
      16_dlurl="https://www.slimjetbrowser.com"
    
      17_libffmpegverurl="https://github.com/nwjs-ffmpeg-prebuilt/nwjs-ffmpeg-prebuilt"
    
      18license=('LicenseRef-freeware')
    
      19depends=(
    
      20    'alsa-lib'
    
      21    'nspr'
    
      22    'nss'
    
      23    'at-spi2-core'
    
      24    'libxrandr'
    
      25    'libxcomposite'
    
      26    'libxdamage'
    
      27    'pango'
    
      28    'cairo'
    
      29    'mesa'
    
      30    'libxkbcommon'
    
      31    'libcups'
    
      32)
    
      33optdepends=(
    
      34    'kdialog: needed for file dialogs in KDE'
    
      35    'ttf-liberation: fix fonts for some PDFs'
    
      36)
    
      37makedepends=(
    
      38    'jq'
    
      39)
    
      40options=(
    
      41    '!emptydirs'
    
      42    '!strip'
    
      43)
    
      44source=(
    
      45    "${pkgname}-${pkgver}.deb::${_dlurl}/release/${pkgname}_amd64.deb"
    
      46    #"${pkgname}-${pkgver}.deb::${url}/release/${pkgname}_amd64.deb"
    
      47    "libffmpeg-${_libffmpegver}.zip::${_libffmpegverurl}/releases/download/${_libffmpegver}/${_libffmpegver}-linux-x64.zip"
    
      48)
    
      49sha256sums=('402eb81ca4e856eaceff69df3c20d9fb4d6519c98b17bbe17de9a92e89e3a594'
    
      50            '8f92b1afc9deda5d896d73af02c26896e2a8877ae05aec6a5fe2fcc34fb59179')
    
      51_get_versions() {
    
      52    _slimjetver="$(strings ${srcdir}/opt/${pkgname}/${pkgname} | grep -oP 'Chrome/\K[0-9]+' | head -n 1)"
    
      53    _slimjetver="${_slimjetver}."
    
      54    _ffmpegver="$(curl -s https://nwjs.io/versions.json | jq -r --arg v "${_slimjetver}" 'limit(1; .versions[] | select(.components.chromium | startswith($v))).version // empty')"
    
      55    echo -e "The chromium version of ${pkgname} is: \033[1;31m${_slimjetver}\033[0m"
    
      56    echo -e "So the ffmpeg version should be: \033[1;31m${_ffmpegver}\033[0m"
    
      57}
    
      58prepare() {
    
      59    bsdtar -xf "${srcdir}/data."*
    
      60    bsdtar -xf "${srcdir}/control."*
    
      61    sed -i -e "
    
      62        s/\/usr\/bin\/${_pkgname}/${_pkgname}/g
    
      63        s/Icon=${_pkgname}/Icon=${pkgname}/g
    
      64    " "${srcdir}/usr/share/applications/${pkgname}.desktop"
    
      65    find "${srcdir}" -type d -exec chmod 755 {} +
    
      66    chmod 0755 "${srcdir}/opt/${pkgname}/${pkgname}-sandbox"
    
      67    sed -i "s/opt\/${pkgname}/usr\/lib\/${pkgname}/g" "${srcdir}/usr/share/gnome-control-center/default-apps/${pkgname}.xml"
    
      68    sed -i "s/opt\/${pkgname}/usr\/lib\/${pkgname}/g" "${srcdir}/usr/share/menu/${pkgname}.menu"
    
      69    _get_versions
    
      70}
    
      71package() {
    
      72    install -Dm755 -d "${pkgdir}/usr/"{bin,lib}
    
      73    cp -Pr --no-preserve=ownership "${srcdir}/opt/${pkgname}" "${pkgdir}/usr/lib"
    
      74    ln -sf "/usr/lib/${pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      75    install -Dm644 "${srcdir}/libffmpeg.so" -t "${pkgdir}/usr/lib/${pkgname}"
    
      76    install -Dm644 "${srcdir}/usr/share/applications/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      77    install -Dm644 "${srcdir}/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      78    _icon_sizes=(16 22 24 32 48 64 128 256)
    
      79    for _icons in "${_icon_sizes[@]}";do
    
      80        install -Dm644 "${srcdir}/opt/${pkgname}/product_logo_${_icons}.png" \
    
      81            "${pkgdir}/usr/share/icons/hicolor/${_icons}x${_icons}/apps/${pkgname}.png"
    
      82    done
    
      83    install -Dm644 "${srcdir}/usr/share/pixmaps/${pkgname}.xpm" -t "${pkgdir}/usr/share/pixmaps"
    
      84    install -Dm644 "${srcdir}/usr/share/menu/${pkgname}.menu" -t "${pkgdir}/usr/share/menu"
    
      85    install -Dm644 "${srcdir}/usr/share/gnome-control-center/default-apps/${pkgname}.xml" \
    
      86        -t "${pkgdir}/usr/share/gnome-control-center/default-apps"
    
      87    chmod 4755 "${pkgdir}/usr/lib/${pkgname}/${pkgname}-sandbox"
    
      88}
    
      89

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2