sub-store-bin

LOW

maintainer ChenPi11 0 votes scanned 2026-09-20 15:33:19.470652

View on AUR

Why flagged

The package installs prebuilt JavaScript files from GitHub releases, which are not locally built but are from the project's official repository; the main risk is unverifiable code execution, but it does not exhibit active malice or remote code download at runtime.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs prebuilt JavaScript files from GitHub releases, which are not locally built but are from the project's official repository; the main risk is unverifiable code execution, but it does not exhibit active malice or remote code download at runtime.

PKGBUILD

      1# Maintainer: chenpi11 <chenpi11@users.noreply.github.com>
    
      2pkgname=sub-store-bin
    
      3pkgver=2.39.9
    
      4pkgrel=1
    
      5pkgdesc='Advanced Subscription Manager for QX, Loon, Surge, Stash, Egern and Shadowrocket'
    
      6arch=('any')
    
      7url='https://github.com/sub-store-org/Sub-Store'
    
      8license=('AGPL-3.0-only')
    
      9depends=('nodejs>=24.15.0')
    
      10makedepends=()
    
      11provides=('sub-store')
    
      12conflicts=('sub-store' 'sub-store-git')
    
      13source=("$url/releases/download/$pkgver/sub-store.bundle.js"
    
      14        "$url/releases/download/$pkgver/cron-sync-artifacts.min.js"
    
      15        "$url/releases/download/$pkgver/runtime-manifest.json"
    
      16        "$url/raw/$pkgver/LICENSE"
    
      17        'sub-store@.service'
    
      18        'sub-store.sysusers'
    
      19        'sub-store.tmpfiles')
    
      20sha256sums=('80d3802ec0494cf942a8b156ba8b1643d566a00b5c2686f86efaccd80ffc67ee'
    
      21            '72aa8870a5d92e352f1deccc6a00c83162beb39b7bb6960aa3b293040aace939'
    
      22            '975e3b64c76c7dcaa03c0ecf3907e94b9a525d8a66ddea56902cd0b64841bb1d'
    
      23            'SKIP'
    
      24            'SKIP'
    
      25            'SKIP'
    
      26            'SKIP')
    
      27
    
      28package() {
    
      29    # Install application files
    
      30    install -Dm644 "$srcdir/sub-store.bundle.js" "$pkgdir/usr/share/sub-store/sub-store.bundle.js"
    
      31    install -Dm644 "$srcdir/cron-sync-artifacts.min.js" "$pkgdir/usr/share/sub-store/cron-sync-artifacts.min.js"
    
      32    install -Dm644 "$srcdir/runtime-manifest.json" "$pkgdir/usr/share/sub-store/runtime-manifest.json"
    
      33    install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      34
    
      35    # Install wrapper script
    
      36    install -Dm755 /dev/stdin "$pkgdir/usr/bin/sub-store" <<'EOF'
    
      37#!/bin/sh
    
      38exec node /usr/share/sub-store/sub-store.bundle.js "$@"
    
      39EOF
    
      40
    
      41    # Install systemd service
    
      42    install -Dm644 "$srcdir/sub-store@.service" "$pkgdir/usr/lib/systemd/system/sub-store@.service"
    
      43
    
      44    # Install sysusers/tmpfiles
    
      45    install -Dm644 "$srcdir/sub-store.sysusers" "$pkgdir/usr/lib/sysusers.d/sub-store.conf"
    
      46    install -Dm644 "$srcdir/sub-store.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/sub-store.conf"
    
      47}
    
      48
    
      49post_install() {
    
      50    echo '==> Sub-Store has been installed!'
    
      51    echo '==> To start the service (default port 9999):'
    
      52    echo '      systemctl enable --now sub-store@9999.service'
    
      53    echo '==> To use a different port:'
    
      54    echo '      systemctl enable --now sub-store@<PORT>.service'
    
      55    echo '==> Web UI: https://sub-store.vercel.app'
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-20 15:33:19	Low	2