speedcat-bin

maintainer heyeuuu · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary (a .deb containing an Electron/ClashMeta-based proxy client) from dl.pbb.dexi009.com, which is a non-standard, unofficial host with no verifiable relationship to a well-known upstream vendor. The sha256sum provides integrity at the moment of packaging, but does not protect against the host owner silently replacing the file in the future (the hash would then mismatch, but the risk is that the maintainer could update the hash without scrutiny). The binary is extracted and installed directly into the system without any source build, meaning users are trusting an opaque prebuilt executable from an obscure CDN. The domain 'dexi009.com' has no obvious association with the stated upstream 'speedcat.me', raising the question of whether this is an official distribution channel. This is a classic supply-chain medium risk: executed binary from an unofficial/personal host, not clearly malicious but not verifiably safe either.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "${_source_archive}::https://dl.pbb.dexi009.com/apps/sc/scapp-linux-lite.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary (a .deb containing an Electron/ClashMeta-based proxy client) from dl.pbb.dexi009.com, which is a non-standard, unofficial host with no verifiable relationship to a well-known upstream vendor. The sha256sum provides integrity at the moment of packaging, but does not protect against the host owner silently replacing the file in the future (the hash would then mismatch, but the risk is that the maintainer could update the hash without scrutiny). The binary is extracted and installed directly into the system without any source build, meaning users are trusting an opaque prebuilt executable from an obscure CDN. The domain 'dexi009.com' has no obvious association with the stated upstream 'speedcat.me', raising the question of whether this is an official distribution channel. This is a classic supply-chain medium risk: executed binary from an unofficial/personal host, not clearly malicious but not verifiably safe either.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: heyeuuu <2829004293@qq.com>
    
      2pkgname=speedcat-bin
    
      3pkgver=3.0.3.2026043013
    
      4pkgrel=1
    
      5pkgdesc="Prebuilt SpeedCat desktop proxy client based on ClashMeta"
    
      6arch=('x86_64')
    
      7url="https://speedcat.me/"
    
      8license=('custom:unknown')
    
      9depends=('gtk3' 'libayatana-appindicator' 'hicolor-icon-theme')
    
      10optdepends=('xdg-utils: open external links from the application')
    
      11provides=("speedcat=${pkgver}")
    
      12conflicts=('speedcat')
    
      13options=('!strip' '!debug')
    
      14noextract=('scapp-linux-lite.zip')
    
      15_source_archive='scapp-linux-lite.zip'
    
      16_upstream_deb='dist/SpeedCat-3.0.3-linux-amd64.deb'
    
      17source=(
    
      18    "${_source_archive}::https://dl.pbb.dexi009.com/apps/sc/scapp-linux-lite.zip"
    
      19)
    
      20sha256sums=(
    
      21    '1e151010e1aaef5b75881c2604a553c7134653ff5c00d2d51dd04b17d91e3976'
    
      22)
    
      23
    
      24package() {
    
      25    cd "${srcdir}"
    
      26
    
      27    local debfile="${srcdir}/SpeedCat-linux-amd64.deb"
    
      28
    
      29    bsdtar -xOf "${_source_archive}" "${_upstream_deb}" > "${debfile}"
    
      30    bsdtar -xOf "${debfile}" data.tar.zst | bsdtar -x -C "${pkgdir}"
    
      31
    
      32    install -dm755 "${pkgdir}/usr/bin"
    
      33    ln -s ../share/SpeedCat/SpeedCat "${pkgdir}/usr/bin/SpeedCat"
    
      34    ln -s SpeedCat "${pkgdir}/usr/bin/speedcat"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2