thunder-mini

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Windows executable (ThunderMini_dl1.5.3.288.exe) from down.sandai.net. This is actually the official Xunlei/Thunder CDN/download domain — sandai.net is the registered domain of Xunlei (迅雷), the company behind Thunder download manager, and down.sandai.net is their standard distribution host. So this is not a 'non-standard' or 'personal' host in the suspicious sense. However, the package installs a prebuilt proprietary Windows binary that is then executed via Wine, and the binary is only verified by an MD5 checksum (weak, but present). The real concern is that a prebuilt, closed-source Windows executable from a Chinese download manager company is being installed and run — this is a legitimate supply-chain concern (the binary could contain adware, spyware, or other unwanted functionality typical of Xunlei products), but it is not an attack or clearly malicious pattern. The source host is the official vendor host. Rating as medium due to the execution of a prebuilt proprietary binary from a vendor known for bundling unwanted software, not due to the host being unofficial.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "http://down.sandai.net/mini/ThunderMini_dl1.5.3.288.exe"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt Windows executable (ThunderMini_dl1.5.3.288.exe) from down.sandai.net. This is actually the official Xunlei/Thunder CDN/download domain — sandai.net is the registered domain of Xunlei (迅雷), the company behind Thunder download manager, and down.sandai.net is their standard distribution host. So this is not a 'non-standard' or 'personal' host in the suspicious sense. However, the package installs a prebuilt proprietary Windows binary that is then executed via Wine, and the binary is only verified by an MD5 checksum (weak, but present). The real concern is that a prebuilt, closed-source Windows executable from a Chinese download manager company is being installed and run — this is a legitimate supply-chain concern (the binary could contain adware, spyware, or other unwanted functionality typical of Xunlei products), but it is not an attack or clearly malicious pattern. The source host is the official vendor host. Rating as medium due to the execution of a prebuilt proprietary binary from a vendor known for bundling unwanted software, not due to the host being unofficial.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: qaz <fkxxyz@163.com>
    
      2# Contributor: qaz <fkxxyz@163.com>
    
      3
    
      4pkgname=thunder-mini
    
      5pkgver=1.5.3.288
    
      6pkgrel=3
    
      7pkgdesc="Xunlei officially released a compact download tool with dedicated download function."
    
      8arch=("i686" "x86_64")
    
      9url="https://dl.xunlei.com/"
    
      10license=('custom')
    
      11makedepends=('p7zip' 'icoutils')
    
      12depends=('bash' 'wine' 'hicolor-icon-theme')
    
      13source=(
    
      14  "http://down.sandai.net/mini/ThunderMini_dl1.5.3.288.exe"
    
      15  "license.txt"
    
      16  "file://${pkgname}.desktop"
    
      17)
    
      18noextract=('ThunderMini_dl1.5.3.288.exe')
    
      19
    
      20_default_env_wineprefix='$HOME/.wine-tool'
    
      21_default_env_winearch='win32'
    
      22_default_env_winedebug='-all'
    
      23_wine_env_file="/etc/wine/appenv/${pkgname}"
    
      24_application_path_root="/opt"
    
      25
    
      26backup=("${_wine_env_file#/*}")
    
      27install="${pkgname}.install"
    
      28
    
      29prepare() {
    
      30  mkdir -p "${srcdir}/pkg"
    
      31  cd "${srcdir}/pkg"
    
      32  7z x -y ../ThunderMini_dl1.5.3.288.exe
    
      33  rm ./Bin/UnInstallClean.exe
    
      34}
    
      35
    
      36_create_launcher(){
    
      37  # $1 Path of position
    
      38  # $2 Relative path to executable in $1 (Windows path format)
    
      39  # $3 Parameters of wine
    
      40  printf '#!/bin/bash
    
      41source '"${_wine_env_file}"'
    
      42
    
      43apphome='"${_application_path_root}/${pkgname}"'
    
      44wine_appdir="$WINEPREFIX/drive_c/Program Files"
    
      45wine_workhome="$wine_appdir/'"${pkgname}"'"
    
      46
    
      47if [ ! -e "${wine_workhome}" ]; then
    
      48  mkdir -p "${wine_appdir}"
    
      49  cp -rs "${apphome}" "${wine_workhome}"
    
      50fi
    
      51
    
      52exec wine "C:\\\\Program Files\\\\'"${pkgname}\\\\$2"'" '"$3"'
    
      53' > "$1"
    
      54}
    
      55
    
      56build() {
    
      57  # Build icon
    
      58  mkdir -p "${srcdir}/ico"
    
      59  wrestool -x -o "${srcdir}/ico" -t14 "${srcdir}/pkg/Bin/ThunderMini.exe"
    
      60  icotool -x -o "${srcdir}/ico" "${srcdir}/ico/ThunderMini.exe_14_116_2052.ico"
    
      61  
    
      62  # Build launcher
    
      63  _create_launcher "thunder-mini" "Bin\\ThunderMini.exe" '$*'
    
      64  
    
      65  # Build env file
    
      66  printf "export WINEPREFIX=${_default_env_wineprefix}
    
      67export WINEARCH=${_default_env_winearch}
    
      68export WINEDEBUG=${_default_env_winedebug}
    
      69" > "${pkgname}.env"
    
      70}
    
      71
    
      72package() {
    
      73
    
      74  # Install application files
    
      75  install -d "${pkgdir}${_application_path_root}/$pkgname"
    
      76  cp -r "$srcdir/pkg/"{Bin,bho,Skin} "${pkgdir}${_application_path_root}/$pkgname/"
    
      77  cp "$srcdir/pkg/\$WINDIR/system32/"* "${pkgdir}${_application_path_root}/$pkgname/Bin/"
    
      78  find "${pkgdir}${_application_path_root}/$pkgname/" -type d -exec chmod 755 {} \;
    
      79  
    
      80  # Install env file
    
      81  install -Dm644 "${pkgname}.env" "${pkgdir}${_wine_env_file}"
    
      82  
    
      83  # Install launcher
    
      84  install -Dm755 "$srcdir/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      85  
    
      86  # Install licenses
    
      87  install -Dm644 "license.txt" "${pkgdir}/usr/share/licenses/$pkgname/license.txt"
    
      88  
    
      89  # Install icon
    
      90  for size in 16x16 32x32 48x48; do
    
      91    install -Dm644 "${srcdir}/ico/ThunderMini.exe_14_116_2052_"?"_${size}x32.png" \
    
      92      "${pkgdir}/usr/share/icons/hicolor/${size}/apps/${pkgname}.png"
    
      93  done
    
      94  
    
      95  # Install desktop file
    
      96  install -Dm644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      97}
    
      98
    
      99# vim:set ts=2 sw=2 et:
    
      100md5sums=('95118524fa7d7e457c7bed4abcb5bbfc'
    
      101         'a04a22f2def04dd4f030de7fc3e83666'
    
      102         '227afd0034719425b6d69379efd6558a')
    
      103
    
      104

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2