slimjet

MEDIUM

maintainer ahmedmoselhi 36 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt binary .deb from a non-whitelisted host and additionally fetches a libffmpeg.zip from GitHub during prepare() without checksum verification, posing a supply-chain risk.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:56 _ffmpegver="$(curl -s https://nwjs.io/versions.json | jq -r --arg v "${_slimjetver}" 'limit(1; .versions[] | select(.components.chromium | startswith($v))).version // empty')"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary .deb from a non-whitelisted host and additionally fetches a libffmpeg.zip from GitHub during prepare() without checksum verification, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ahmedmoselhi
    
      2# Co-Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      3# Contributor: raininja <dandenkijin ad gmail dot com>
    
      4# Contributor: eagleeyetom <eagleeyetom at gmail dot com>
    
      5# Contributor: dalto <dalto at fastmail dot com>
    
      6pkgname=slimjet
    
      7_pkgname="flashpeak-${pkgname}"
    
      8pkgver=51.0.1.0
    
      9# curl -s https://nwjs.io/versions.json | jq -r 'limit(1; .versions[] | select(.components.chromium | startswith("137.")) | .version)'
    
      10# strings src/opt/slimjet/slimjet | grep -Eo '^Chrome/([0-9]+(\.[0-9]+)+)' | head -n 1
    
      11pkgrel=1
    
      12pkgdesc="Fast, smart and powerful browser based on Blink.(Prebuilt version)"
    
      13arch=('x86_64')
    
      14url="https://www.slimjet.com"
    
      15_dlurl="https://www.slimjetbrowser.com"
    
      16_libffmpegverurl="https://github.com/nwjs-ffmpeg-prebuilt/nwjs-ffmpeg-prebuilt"
    
      17license=('LicenseRef-freeware')
    
      18depends=(
    
      19    'alsa-lib'
    
      20    'nspr'
    
      21    'nss'
    
      22    'at-spi2-core'
    
      23    'libxrandr'
    
      24    'libxcomposite'
    
      25    'libxdamage'
    
      26    'pango'
    
      27    'cairo'
    
      28    'mesa'
    
      29    'libxkbcommon'
    
      30    'libcups'
    
      31)
    
      32optdepends=(
    
      33    'kdialog: needed for file dialogs in KDE'
    
      34    'ttf-liberation: fix fonts for some PDFs'
    
      35)
    
      36makedepends=(
    
      37    'jq'
    
      38    'curl'
    
      39    'wget'
    
      40)
    
      41options=(
    
      42    '!emptydirs'
    
      43    '!strip'
    
      44)
    
      45source=(
    
      46    "${pkgname}-${pkgver}.deb::${_dlurl}/release/${pkgname}_amd64.deb"
    
      47    #"${pkgname}-${pkgver}.deb::${url}/release/${pkgname}_amd64.deb"
    
      48)
    
      49sha256sums=('SKIP')
    
      50pkgver() {
    
      51	cat "${srcdir}/.pkgver" 2>/dev/null || echo "${pkgver}"
    
      52}
    
      53_get_ffmpeg() {
    
      54    _slimjetver="$(strings ${srcdir}/opt/${pkgname}/${pkgname} | grep -oP 'Chrome/\K[0-9]+' | head -n 1)"
    
      55    _slimjetver="${_slimjetver}."
    
      56    _ffmpegver="$(curl -s https://nwjs.io/versions.json | jq -r --arg v "${_slimjetver}" 'limit(1; .versions[] | select(.components.chromium | startswith($v))).version // empty')"
    
      57    echo -e "The chromium version of ${pkgname} is: \033[1;31m${_slimjetver}\033[0m"
    
      58    echo -e "So the ffmpeg version should be: \033[1;31m${_ffmpegver}\033[0m"
    
      59    wget -c "${_libffmpegverurl}/releases/download/${_ffmpegver#v}/${_ffmpegver#v}-linux-x64.zip" -O "${srcdir}/libffmpeg.zip"
    
      60    bsdtar -xf "${srcdir}/libffmpeg.zip"
    
      61}
    
      62prepare() {
    
      63    bsdtar -xf "${srcdir}/data."*
    
      64    bsdtar -xf "${srcdir}/control."*
    
      65    sed -n 's/^Version:[[:space:]]*//p' "${srcdir}/control" > "${srcdir}/.pkgver"
    
      66    sed -i -e "
    
      67        s/\/usr\/bin\/${_pkgname}/${_pkgname}/g
    
      68        s/Icon=${_pkgname}/Icon=${pkgname}/g
    
      69    " "${srcdir}/usr/share/applications/${pkgname}.desktop"
    
      70    find "${srcdir}" -type d -exec chmod 755 {} +
    
      71    chmod 0755 "${srcdir}/opt/${pkgname}/${pkgname}-sandbox"
    
      72    sed -i "s/opt\/${pkgname}/usr\/lib\/${pkgname}/g" "${srcdir}/usr/share/gnome-control-center/default-apps/${pkgname}.xml"
    
      73    sed -i "s/opt\/${pkgname}/usr\/lib\/${pkgname}/g" "${srcdir}/usr/share/menu/${pkgname}.menu"
    
      74    _get_ffmpeg
    
      75}
    
      76package() {
    
      77    install -Dm755 -d "${pkgdir}/usr/"{bin,lib}
    
      78    cp -a "${srcdir}/opt/${pkgname}" "${pkgdir}/usr/lib"
    
      79    ln -sf "/usr/lib/${pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      80    install -Dm644 "${srcdir}/libffmpeg.so" -t "${pkgdir}/usr/lib/${pkgname}"
    
      81    install -Dm644 "${srcdir}/usr/share/applications/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      82    install -Dm644 "${srcdir}/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      83    _icon_sizes=(16 22 24 32 48 64 128 256)
    
      84    for _icons in "${_icon_sizes[@]}";do
    
      85        install -Dm644 "${srcdir}/opt/${pkgname}/product_logo_${_icons}.png" \
    
      86            "${pkgdir}/usr/share/icons/hicolor/${_icons}x${_icons}/apps/${pkgname}.png"
    
      87    done
    
      88    install -Dm644 "${srcdir}/usr/share/pixmaps/${pkgname}.xpm" -t "${pkgdir}/usr/share/pixmaps"
    
      89    install -Dm644 "${srcdir}/usr/share/menu/${pkgname}.menu" -t "${pkgdir}/usr/share/menu"
    
      90    install -Dm644 "${srcdir}/usr/share/gnome-control-center/default-apps/${pkgname}.xml" \
    
      91        -t "${pkgdir}/usr/share/gnome-control-center/default-apps"
    
      92    chmod 4755 "${pkgdir}/usr/lib/${pkgname}/${pkgname}-sandbox"
    
      93}
    
      94

Changes since previous scan

--- PKGBUILD @ 2026-10-30 00:29
+++ PKGBUILD @ 2026-11-01 00:21
@@ -5,10 +5,9 @@
 # Contributor: dalto <dalto at fastmail dot com>
 pkgname=slimjet
 _pkgname="flashpeak-${pkgname}"
-pkgver=50.0.0.0
+pkgver=51.0.1.0
 # curl -s https://nwjs.io/versions.json | jq -r 'limit(1; .versions[] | select(.components.chromium | startswith("137.")) | .version)'
 # strings src/opt/slimjet/slimjet | grep -Eo '^Chrome/([0-9]+(\.[0-9]+)+)' | head -n 1
-_libffmpegver=0.107.0
 pkgrel=1
 pkgdesc="Fast, smart and powerful browser based on Blink.(Prebuilt version)"
 arch=('x86_64')
@@ -36,6 +35,8 @@
 )
 makedepends=(
     'jq'
+    'curl'
+    'wget'
 )
 options=(
     '!emptydirs'
@@ -44,20 +45,24 @@
 source=(
     "${pkgname}-${pkgver}.deb::${_dlurl}/release/${pkgname}_amd64.deb"
     #"${pkgname}-${pkgver}.deb::${url}/release/${pkgname}_amd64.deb"
-    "libffmpeg-${_libffmpegver}.zip::${_libffmpegverurl}/releases/download/${_libffmpegver}/${_libffmpegver}-linux-x64.zip"
 )
-sha256sums=('402eb81ca4e856eaceff69df3c20d9fb4d6519c98b17bbe17de9a92e89e3a594'
-            '8f92b1afc9deda5d896d73af02c26896e2a8877ae05aec6a5fe2fcc34fb59179')
-_get_versions() {
+sha256sums=('SKIP')
+pkgver() {
+	cat "${srcdir}/.pkgver" 2>/dev/null || echo "${pkgver}"
+}
+_get_ffmpeg() {
     _slimjetver="$(strings ${srcdir}/opt/${pkgname}/${pkgname} | grep -oP 'Chrome/\K[0-9]+' | head -n 1)"
     _slimjetver="${_slimjetver}."
     _ffmpegver="$(curl -s https://nwjs.io/versions.json | jq -r --arg v "${_slimjetver}" 'limit(1; .versions[] | select(.components.chromium | startswith($v))).version // empty')"
     echo -e "The chromium version of ${pkgname} is: \033[1;31m${_slimjetver}\033[0m"
     echo -e "So the ffmpeg version should be: \033[1;31m${_ffmpegver}\033[0m"
+    wget -c "${_libffmpegverurl}/releases/download/${_ffmpegver#v}/${_ffmpegver#v}-linux-x64.zip" -O "${srcdir}/libffmpeg.zip"
+    bsdtar -xf "${srcdir}/libffmpeg.zip"
 }
 prepare() {
     bsdtar -xf "${srcdir}/data."*
     bsdtar -xf "${srcdir}/control."*
+    sed -n 's/^Version:[[:space:]]*//p' "${srcdir}/control" > "${srcdir}/.pkgver"
     sed -i -e "
         s/\/usr\/bin\/${_pkgname}/${_pkgname}/g
         s/Icon=${_pkgname}/Icon=${pkgname}/g
@@ -66,11 +71,11 @@
     chmod 0755 "${srcdir}/opt/${pkgname}/${pkgname}-sandbox"
     sed -i "s/opt\/${pkgname}/usr\/lib\/${pkgname}/g" "${srcdir}/usr/share/gnome-control-center/default-apps/${pkgname}.xml"
     sed -i "s/opt\/${pkgname}/usr\/lib\/${pkgname}/g" "${srcdir}/usr/share/menu/${pkgname}.menu"
-    _get_versions
+    _get_ffmpeg
 }
 package() {
     install -Dm755 -d "${pkgdir}/usr/"{bin,lib}
-    cp -Pr --no-preserve=ownership "${srcdir}/opt/${pkgname}" "${pkgdir}/usr/lib"
+    cp -a "${srcdir}/opt/${pkgname}" "${pkgdir}/usr/lib"
     ln -sf "/usr/lib/${pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
     install -Dm644 "${srcdir}/libffmpeg.so" -t "${pkgdir}/usr/lib/${pkgname}"
     install -Dm644 "${srcdir}/usr/share/applications/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 09:55:25	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2