tea-wind-bin

maintainer Teamon · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary package (a Debian .deb inside a ZIP) from d-cdn.wind.com.cn, which appears to be Wind Information Co.'s (万得) official CDN domain for their Linux client distribution. The domain is plausibly official for this Chinese financial data vendor. However, the concern is real: (1) a prebuilt binary blob is downloaded and installed directly with no source build, (2) the version string is partially baked into the URL (the suffix lacks the version, meaning the ZIP filename is static and could be silently updated server-side), (3) there is a sha512sum provided but it covers only the outer ZIP, not the inner .deb or its extracted binaries, and (4) Wind terminal is a proprietary financial application with deep system integration. The supply-chain risk is genuine — if the CDN host or the ZIP contents were substituted, arbitrary code would execute with user privileges. This is a classic 'binary from vendor CDN' medium-risk pattern, not a clear attack, but not clean either.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://d-cdn.wind.com.cn/windnet/linux/${pkgprefix}_${pkgsuffix}.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary package (a Debian .deb inside a ZIP) from d-cdn.wind.com.cn, which appears to be Wind Information Co.'s (万得) official CDN domain for their Linux client distribution. The domain is plausibly official for this Chinese financial data vendor. However, the concern is real: (1) a prebuilt binary blob is downloaded and installed directly with no source build, (2) the version string is partially baked into the URL (the suffix lacks the version, meaning the ZIP filename is static and could be silently updated server-side), (3) there is a sha512sum provided but it covers only the outer ZIP, not the inner .deb or its extracted binaries, and (4) Wind terminal is a proprietary financial application with deep system integration. The supply-chain risk is genuine — if the CDN host or the ZIP contents were substituted, arbitrary code would execute with user privileges. This is a classic 'binary from vendor CDN' medium-risk pattern, not a clear attack, but not clean either.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Teamon <teamon9161@163.com>
    
      2
    
      3pkgname=tea-wind-bin
    
      4_pkgname=wind
    
      5pkgver=26.1.0.04151
    
      6pkgrel=1
    
      7pkgdesc="Wind financial terminal, 万得金融终端"
    
      8arch=("x86_64")
    
      9url="http://www.wind.com.cn"
    
      10license=("unknown")
    
      11depends=('libidn11' 'libxcrypt-compat' 'openssl-1.1')
    
      12provides=("$_pkgname")
    
      13install=wind-bin.install
    
      14pkgprefix="com.wind.wft-kylinV10SP1"
    
      15pkgsuffix="amd64.deb"
    
      16source=("https://d-cdn.wind.com.cn/windnet/linux/${pkgprefix}_${pkgsuffix}.zip")
    
      17
    
      18sha512sums=('9e43939849a49cad32c7bbd284b05fef66eaa9ba3ec1d5f829c6628c5a9d2682e4df64e5743ebdaef6b8c5b325ba4342082e9a88bd5ff5984574d92edd044d64')
    
      19
    
      20prepare(){
    
      21    cd ${srcdir}
    
      22    unzip -o ${pkgprefix}_${pkgsuffix}.zip
    
      23    ar p "com.wind.wft_${pkgver}_${pkgsuffix}" data.tar.xz | tar xJf -
    
      24
    
      25}
    
      26package(){
    
      27
    
      28    cd $srcdir
    
      29    mkdir -p $pkgdir/opt
    
      30    cp -rf usr $pkgdir/
    
      31
    
      32    mkdir -p ${pkgdir}/opt/apps
    
      33    cp -rf opt/apps/com.wind.wft   ${pkgdir}/opt/apps
    
      34    cp -rf usr/share/* ${pkgdir}/usr/share
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2