spokenly

maintainer AsukaMinato · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Downloads and installs a prebuilt binary .deb from cdn.spokenly.app, a CDN/personal host unrelated to a major forge; while it appears to be the project's own official CDN, it is unverifiable and the binary runs directly without source build, making silent substitution a realistic supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "Spokenly_${pkgver}_amd64.deb::https://cdn.spokenly.app/releases/linux/Spokenly_${pkgver}_amd64.deb"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Downloads and installs a prebuilt binary .deb from cdn.spokenly.app, a CDN/personal host unrelated to a major forge; while it appears to be the project's own official CDN, it is unverifiable and the binary runs directly without source build, making silent substitution a realistic supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: w
    
      2
    
      3pkgname=spokenly
    
      4pkgver=0.3.8
    
      5pkgrel=1
    
      6pkgdesc='Fast voice dictation for your desktop'
    
      7arch=('x86_64')
    
      8url='https://spokenly.app/'
    
      9license=('LicenseRef-Spokenly')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'cairo'
    
      13  'gcc-libs'
    
      14  'gdk-pixbuf2'
    
      15  'glib2'
    
      16  'glibc'
    
      17  'gtk3'
    
      18  'hicolor-icon-theme'
    
      19  'libayatana-appindicator'
    
      20  'libevdev'
    
      21  'libsoup3'
    
      22  'libx11'
    
      23  'libxtst'
    
      24  'webkit2gtk-4.1'
    
      25)
    
      26provides=('spokenly')
    
      27conflicts=('spokenly')
    
      28options=('!strip')
    
      29source=(
    
      30  "Spokenly_${pkgver}_amd64.deb::https://cdn.spokenly.app/releases/linux/Spokenly_${pkgver}_amd64.deb"
    
      31  'LICENSE'
    
      32)
    
      33sha256sums=('d909cceeab1ff78553a300d3dce0fd906ae87e3083842f0babf22f002af18e37'
    
      34            '36281e6dc02d369943554f1681ee1aae9d86429fc7a6e5b44b53f6c620b5dffe')
    
      35
    
      36package() {
    
      37  bsdtar -xpf data.tar.gz -C "$pkgdir"
    
      38  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 05:24:12	MEDIUM	3
2026-07-23 05:22:32	MEDIUM	3