speedcat-bin

MEDIUM

maintainer heyeuuu 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb file from a non-standard, non-whitelisted host (dl.pbbapi.hnlskj98.com), which is then extracted and installed; this presents a supply-chain risk as the binary could be silently replaced.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "${_source_archive}::https://dl.pbbapi.hnlskj98.com/apps/sc/scapp-linux-lite.zip"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb file from a non-standard, non-whitelisted host (dl.pbbapi.hnlskj98.com), which is then extracted and installed; this presents a supply-chain risk as the binary could be silently replaced.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: heyeuuu <2829004293@qq.com>
    
      2pkgname=speedcat-bin
    
      3pkgver=3.1.8.2026071515
    
      4pkgrel=1
    
      5pkgdesc="Prebuilt SpeedCat desktop proxy client based on ClashMeta"
    
      6arch=('x86_64')
    
      7url="https://speedcat.me/"
    
      8license=('custom:unknown')
    
      9depends=('gtk3' 'libayatana-appindicator' 'libkeybinder3' 'hicolor-icon-theme')
    
      10optdepends=('xdg-utils: open external links from the application')
    
      11provides=("speedcat=${pkgver}")
    
      12conflicts=('speedcat')
    
      13options=('!strip' '!debug')
    
      14noextract=('scapp-linux-lite.zip')
    
      15_source_archive='scapp-linux-lite.zip'
    
      16_upstream_deb='dist/SpeedCat-3.1.8-linux-amd64.deb'
    
      17source=(
    
      18    "${_source_archive}::https://dl.pbbapi.hnlskj98.com/apps/sc/scapp-linux-lite.zip"
    
      19)
    
      20sha256sums=(
    
      21    '30f48119eea3774ffb9fb9cddb75fb3a2887e33943c523e2e6d65b5ee8b9e521'
    
      22)
    
      23
    
      24package() {
    
      25    cd "${srcdir}"
    
      26
    
      27    local debfile="${srcdir}/SpeedCat-linux-amd64.deb"
    
      28
    
      29    bsdtar -xOf "${_source_archive}" "${_upstream_deb}" > "${debfile}"
    
      30    bsdtar -xOf "${debfile}" data.tar.zst | bsdtar -x -C "${pkgdir}"
    
      31
    
      32    install -dm755 "${pkgdir}/usr/bin"
    
      33    ln -s ../share/SpeedCat/SpeedCat "${pkgdir}/usr/bin/SpeedCat"
    
      34    ln -s SpeedCat "${pkgdir}/usr/bin/speedcat"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2