smartbrowser-bin

maintainer dakshchoudhary · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Electron/Chromium-based binary (.deb) from cdn.hackerearth.com and installs it directly onto the system. The sha256sums is set to 'SKIP', meaning there is no integrity verification whatsoever — any silent replacement or CDN compromise would go undetected. While cdn.hackerearth.com is the official CDN for HackerEarth (a legitimate proctoring/assessment platform), the combination of: (1) a fully executable binary blob, (2) no checksum verification, and (3) installation of an Electron app with broad system access (screen capture, audio, etc.) constitutes a genuine supply-chain risk. The host is plausibly official but not a well-known, widely-audited distribution channel, and SKIP checksums for executed binaries are a real concern regardless of source legitimacy. This is a textbook medium-severity case.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:54 source=("smartbrowser.deb::https://cdn.hackerearth.com/smart-browser/releases/linux/x64/smart-browser-${pkgver}.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt Electron/Chromium-based binary (.deb) from cdn.hackerearth.com and installs it directly onto the system. The sha256sums is set to 'SKIP', meaning there is no integrity verification whatsoever — any silent replacement or CDN compromise would go undetected. While cdn.hackerearth.com is the official CDN for HackerEarth (a legitimate proctoring/assessment platform), the combination of: (1) a fully executable binary blob, (2) no checksum verification, and (3) installation of an Electron app with broad system access (screen capture, audio, etc.) constitutes a genuine supply-chain risk. The host is plausibly official but not a well-known, widely-audited distribution channel, and SKIP checksums for executed binaries are a real concern regardless of source legitimacy. This is a textbook medium-severity case.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Daksh Choudhary <ch.daksh01@gmail.com>
    
      2# Maintainer: Vivek Sudan <s.viveksudan@gmail.com>
    
      3
    
      4pkgname=smartbrowser-bin
    
      5pkgver=2.4.1
    
      6pkgrel=3
    
      7pkgdesc="HackerEarth Smart Browser for secure assessments"
    
      8arch=('x86_64')
    
      9url="https://www.hackerearth.com/challenges/smart-browser/sap-9/"
    
      10license=('custom')
    
      11
    
      12provides=('smartbrowser')
    
      13conflicts=('smartbrowser')
    
      14
    
      15# Runtime dependencies (Electron/Chromium stack)
    
      16depends=(
    
      17  'gtk3'
    
      18  'glib2'
    
      19  'nss'
    
      20  'libxss'
    
      21  'alsa-lib'
    
      22  'libxtst'
    
      23  'libxrandr'
    
      24  'libxdamage'
    
      25  'libxcomposite'
    
      26  'libxfixes'
    
      27  'at-spi2-core'
    
      28  'libdrm'
    
      29  'mesa'
    
      30  'libxcb'
    
      31  'libx11'
    
      32  'libxkbcommon'
    
      33  'pango'
    
      34  'cairo'
    
      35  'expat'
    
      36  'libcups'
    
      37)
    
      38
    
      39# Optional runtime improvements
    
      40optdepends=(
    
      41  'pipewire: screen/audio capture'
    
      42  'pulseaudio: audio support'
    
      43  'wayland: Wayland support'
    
      44  'xdg-utils: open links properly'
    
      45)
    
      46
    
      47# BUILD-TIME dependencies
    
      48makedepends=(
    
      49  'libarchive'
    
      50)
    
      51
    
      52options=('!strip' '!debug')
    
      53
    
      54source=("smartbrowser.deb::https://cdn.hackerearth.com/smart-browser/releases/linux/x64/smart-browser-${pkgver}.deb")
    
      55
    
      56sha256sums=('SKIP')
    
      57
    
      58package() {
    
      59  cd "$srcdir"
    
      60
    
      61  # Extract data archive
    
      62  bsdtar -xf smartbrowser.deb
    
      63  bsdtar -xf data.tar.* -C "$pkgdir"
    
      64
    
      65  # Fix permissions
    
      66  chmod -R 755 "$pkgdir/usr"
    
      67
    
      68  # Fix Debian-specific lib path
    
      69  if [ -d "$pkgdir/usr/lib/x86_64-linux-gnu" ]; then
    
      70    mkdir -p "$pkgdir/usr/lib"
    
      71    mv "$pkgdir/usr/lib/x86_64-linux-gnu/"* "$pkgdir/usr/lib/"
    
      72    rmdir "$pkgdir/usr/lib/x86_64-linux-gnu"
    
      73  fi
    
      74
    
      75  # Fix desktop entry (important for KDE/GNOME)
    
      76  if [ -f "$pkgdir/usr/share/applications/smart-browser.desktop" ]; then
    
      77    install -Dm644 "$pkgdir/usr/share/applications/smart-browser.desktop" \
    
      78      "$pkgdir/usr/share/applications/smartbrowser.desktop"
    
      79  fi
    
      80
    
      81  # License install
    
      82  if [ -f "$pkgdir/usr/share/doc/smart-browser/copyright" ]; then
    
      83    install -Dm644 "$pkgdir/usr/share/doc/smart-browser/copyright" \
    
      84      "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      85  fi
    
      86}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2