splayer-next-unofficial-bin

maintainer wkk-dev · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Installs a prebuilt Electron binary from the maintainer's own GitHub releases with verified sha256 checksums; the setuid on chrome-sandbox is standard Electron packaging practice, not malicious, though this is an unofficial/personal repackage with few votes.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Installs a prebuilt Electron binary from the maintainer's own GitHub releases with verified sha256 checksums; the setuid on chrome-sandbox is standard Electron packaging practice, not malicious, though this is an unofficial/personal repackage with few votes.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:55 chmod 4755 "${pkgdir}/opt/splayer-next/chrome_crashpad_handler" 2>/dev/null || true

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: wkk-dev <wkk-dev@qq.com>
    
      2
    
      3# === 包基本信息 ===
    
      4pkgname=splayer-next-unofficial-bin
    
      5pkgver=1.0.0
    
      6pkgrel=2
    
      7pkgdesc="非官方 - SPlayer-Next - 🎵 跨平台桌面音乐播放器，支持丰富的歌词展现形式与广泛的音频格式「SPlayer」的继任版本"
    
      8arch=('x86_64')
    
      9url="https://github.com/wkk-dev/SPlayer-Next-linux"
    
      10license=('AGPL-3.0')
    
      11
    
      12# === 依赖 ===
    
      13depends=('libappindicator-gtk3'
    
      14         'libxss'
    
      15         'libxtst'
    
      16         'libnotify')
    
      17optdepends=('pipewire: 音频后端'
    
      18            'pulseaudio: 音频后端')
    
      19
    
      20# === 源文件 ===
    
      21_github="https://github.com/wkk-dev/SPlayer-Next-linux"
    
      22_tarball="splayer-next-${pkgver}-x64.tar.gz"
    
      23_dirname="splayer-next-${pkgver}-x64"
    
      24_icon="splayer-next.png"
    
      25
    
      26source=("${_tarball}::${_github}/releases/download/v${pkgver}/${_tarball}"
    
      27        "${_icon}::${_github}/raw/v${pkgver}/public/icons/favicon.png")
    
      28sha256sums=('2894a9eadd397198d6b98661d9d884bc4d2deaf0913c85886ee7608a79853ca7'
    
      29            '6f18e6af0430496e2c7aab4ed559e6b6efe87bc7880b8fe6e52451674296b248')
    
      30
    
      31# === 打包 ===
    
      32package() {
    
      33  cd "${srcdir}/${_dirname}"
    
      34
    
      35  # 安装主程序到 /opt
    
      36  install -dm755 "${pkgdir}/opt/splayer-next"
    
      37  cp -r . "${pkgdir}/opt/splayer-next/"
    
      38
    
      39  # 查找实际的可执行文件名（electron-builder 配置的 executableName）
    
      40  local exec_name="SPlayer-Next"
    
      41  if [ ! -f "${pkgdir}/opt/splayer-next/${exec_name}" ]; then
    
      42    # 回退：查找任意 ELF 可执行文件
    
      43    exec_name=$(find "${pkgdir}/opt/splayer-next" -maxdepth 1 -type f -executable | head -1)
    
      44    exec_name=$(basename "$exec_name")
    
      45  fi
    
      46  echo "检测到可执行文件: ${exec_name}"
    
      47
    
      48  # 符号链接到 /usr/bin
    
      49  install -dm755 "${pkgdir}/usr/bin"
    
      50  ln -sf "/opt/splayer-next/${exec_name}" \
    
      51    "${pkgdir}/usr/bin/splayer-next"
    
      52
    
      53  # chrome-sandbox 需要 setuid
    
      54  chmod 4755 "${pkgdir}/opt/splayer-next/chrome-sandbox" 2>/dev/null || true
    
      55  chmod 4755 "${pkgdir}/opt/splayer-next/chrome_crashpad_handler" 2>/dev/null || true
    
      56
    
      57  # 移除冲突的捆绑系统库（使用系统版本）
    
      58  rm -f "${pkgdir}/opt/splayer-next/libXss.so"* \
    
      59        "${pkgdir}/opt/splayer-next/libXtst.so"* \
    
      60        "${pkgdir}/opt/splayer-next/libnotify.so"*
    
      61
    
      62  # 桌面文件
    
      63  install -dm755 "${pkgdir}/usr/share/applications"
    
      64  cat > "${pkgdir}/usr/share/applications/splayer-next.desktop" << 'DESKEOF'
    
      65[Desktop Entry]
    
      66Name=SPlayer-Next
    
      67GenericName=Music Player
    
      68Comment=现代化跨平台桌面音乐播放器，支持丰富的歌词显示与多种音频格式
    
      69Exec=splayer-next
    
      70Icon=splayer-next
    
      71Terminal=false
    
      72Type=Application
    
      73Categories=Audio;Music;Player;
    
      74StartupWMClass=splayer-next
    
      75MimeType=audio/mpeg;audio/flac;audio/wav;audio/ogg;audio/aac;
    
      76DESKEOF
    
      77
    
      78  # 图标
    
      79  install -Dm644 "${srcdir}/${_icon}" \
    
      80    "${pkgdir}/usr/share/pixmaps/splayer-next.png"
    
      81  install -Dm644 "${srcdir}/${_icon}" \
    
      82    "${pkgdir}/usr/share/icons/hicolor/120x120/apps/splayer-next.png"
    
      83}
    
      84

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 13:22:57	LOW	3
2026-07-22 13:20:28	MEDIUM	3