snapmakerjs

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 "https://s3-us-west-2.amazonaws.com/snapmaker.com/download/snapmakerjs/snapmakerjs-${pkgver}-linux-amd64.deb"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from an AWS S3 bucket (snapmaker.com/download/...) and installs its contents directly. While the S3 bucket appears to be the official Snapmaker distribution channel (the URL path includes the vendor domain 'snapmaker.com'), S3 buckets are not the same as a vendor's own infrastructure — bucket names can be squatted or misconfigured, and there is no cryptographic verification beyond a weak MD5 checksum. The package extracts and installs a prebuilt binary (an Electron app) directly into /opt and /usr without any build step, meaning whatever is in the .deb is executed on the user's system. The MD5 hash provides minimal integrity assurance (MD5 is broken for collision resistance). This is a real supply-chain concern: a compromised or hijacked S3 bucket would deliver a malicious executable with no strong verification. However, this pattern (vendor distributing via S3 with an MD5 checksum) is common in AUR packages for proprietary software, and there is no evidence of active malice. The medium rating is appropriate.