terabox-bin
maintainer okbzl
· 4 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt .deb from a non-standard, non-official host (data.nephobox.com), which is not controlled by the software vendor, creating a supply-chain risk if the host is compromised or the download is swapped.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:27
source=("https://data.nephobox.com/issue/terabox/Linux/${pkgver}/${_pkgname}_${pkgver}_amd64.deb")
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard, non-official host (data.nephobox.com), which is not controlled by the software vendor, creating a supply-chain risk if the host is compromised or the download is swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Okabe Zero-Link (okbzl). Email: okabezerolink@gmail.com
2
# Contributor: BadBoy <luckmelove2@gmail.com>
3
#
4
pkgname='terabox-bin'
5
_pkgname="$(echo $pkgname |cut -d - -f 1 | tr 'tb' 'TB')"
6
pkgver='1.46.1'
7
pkgrel='1'
8
pkgdesc='Baidu netdisc international version'
9
arch=('x86_64')
10
license=('custom')
11
url='https://www.terabox.com/chinese/'
12
13
depends=(
14
'gtkmm3'
15
'gtkmm'
16
'nspr'
17
'nodejs'
18
'alsa-lib'
19
'nss'
20
)
21
22
optdepends=(
23
'libappindicator-gtk3'
24
)
25
26
# DEB package
27
source=("https://data.nephobox.com/issue/terabox/Linux/${pkgver}/${_pkgname}_${pkgver}_amd64.deb")
28
29
sha256sums=('c11639ff8d17f12888b049373987bc6e87d0718df4b11cb6178004ae5c45048b')
30
31
options=(!strip)
32
33
prepare() {
34
bsdtar -xpf "data.tar.bz2"
35
}
36
37
package() {
38
cd "${srcdir}"
39
40
# install application data
41
mv -v "usr" "${pkgdir}"
42
43
install -dm755 "${pkgdir}/usr/lib" "${pkgdir}/usr/share/licenses/${_pkgname}" "${pkgdir}/opt"
44
mv "opt/${_pkgname}" "${pkgdir}/opt/"
45
46
# fix promission
47
chmod 644 "${pkgdir}/opt/${_pkgname}/"*.so
48
find ${pkgdir} -type d -exec chmod 755 {} \;
49
50
# install license
51
ln -s "/usr/lib/${_pkgname}/LICENSE.electron.txt" \
52
"${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE.electron.txt"
53
ln -s "/usr/lib/${_pkgname}/LICENSES.chromium.html" \
54
"${pkgdir}/usr/share/licenses/${_pkgname}/LICENSES.chromium.html"
55
}
56
57
Changes since previous scan
--- PKGBUILD @ 2026-07-29 00:25+++ PKGBUILD @ 2026-08-03 00:08@@ -3,7 +3,7 @@ # pkgname='terabox-bin' _pkgname="$(echo $pkgname |cut -d - -f 1 | tr 'tb' 'TB')"-pkgver='1.45.0'+pkgver='1.46.1' pkgrel='1' pkgdesc='Baidu netdisc international version' arch=('x86_64')@@ -26,7 +26,7 @@ # DEB package source=("https://data.nephobox.com/issue/terabox/Linux/${pkgver}/${_pkgname}_${pkgver}_amd64.deb") -sha256sums=('8b93d0d0c919b1bdd2ac62f88dbba7a2057d82016f74fe2836f88c7109991898')+sha256sums=('c11639ff8d17f12888b049373987bc6e87d0718df4b11cb6178004ae5c45048b') options=(!strip) Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 15:12:02 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 03:15:42 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |