tiantianmazi-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs a prebuilt binary .deb package from 'asset.yycdn.cn', which is a CDN/asset host rather than the official project domain (tiantianmazi.com). The binary is an Electron application that gets installed directly to /opt and executed. While yycdn.cn appears to be a Chinese CDN service that could plausibly be the vendor's own CDN, it is not the official domain and cannot be independently verified as such. The sha256sum provides some integrity protection against interception, but does not protect against a compromised upstream host serving a malicious binary. Installing and executing prebuilt binaries from unofficial/CDN hosts that cannot be verified as the vendor's own infrastructure represents a genuine supply-chain risk, consistent with a MEDIUM rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "${pkgname%-bin}-${pkgver}.deb::http://asset.yycdn.cn/app/%E5%A4%A9%E5%A4%A9%E7%A0%81%E5%AD%97.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and installs a prebuilt binary .deb package from 'asset.yycdn.cn', which is a CDN/asset host rather than the official project domain (tiantianmazi.com). The binary is an Electron application that gets installed directly to /opt and executed. While yycdn.cn appears to be a Chinese CDN service that could plausibly be the vendor's own CDN, it is not the official domain and cannot be independently verified as such. The sha256sum provides some integrity protection against interception, but does not protect against a compromised upstream host serving a malicious binary. Installing and executing prebuilt binaries from unofficial/CDN hosts that cannot be verified as the vendor's own infrastructure represents a genuine supply-chain risk, consistent with a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=tiantianmazi-bin
    
      3_chsname="天天码字"
    
      4_appname=ttmz
    
      5pkgver=1.0.1
    
      6_electronversion=22
    
      7pkgrel=6
    
      8pkgdesc="天天码字是面向网文作者人群的一款方便,适用的码字工具平台."
    
      9arch=('x86_64')
    
      10url="http://www.tiantianmazi.com/"
    
      11license=('LicenseRef-custom')
    
      12provides=("${_appname}")
    
      13conflicts=("${pkgname%-bin}" "${_appname}")
    
      14depends=(
    
      15    'alsa-lib'
    
      16    'gtk3'
    
      17    'nodejs'
    
      18    'nss'
    
      19    'nspr'
    
      20    'python-setuptools'
    
      21)
    
      22source=(
    
      23    "${pkgname%-bin}-${pkgver}.deb::http://asset.yycdn.cn/app/%E5%A4%A9%E5%A4%A9%E7%A0%81%E5%AD%97.deb"
    
      24    "LICENSE-${pkgver}.html::${url}/agreement.html"
    
      25)
    
      26sha256sums=('8dbb468c3fb9e03f63c543d68c2b2855b6381df153aada3a0ea4ff8d87de937b'
    
      27            '92d01a96c324eb11ef8600d1014c5ac041c7ad30649f399a5c3fd83181b6ab30')
    
      28build() {
    
      29    bsdtar -xf "${srcdir}/data."*
    
      30    sed "s|/opt/${_chsname}/${_appname}.png|${pkgname%-bin}|g;s|\"/opt/${_chsname}/${_appname}\"|${pkgname%-bin}|g" \
    
      31        -i "${srcdir}/usr/share/applications/${_appname}.desktop"
    
      32}
    
      33package() {
    
      34    install -Dm755 -d "${pkgdir}/"{opt/"${pkgname%-bin}",usr/bin}
    
      35    cp -r "${srcdir}/opt/${_chsname}/"* "${pkgdir}/opt/${pkgname%-bin}"
    
      36    ln -sf "/opt/${pkgname%-bin}/${_appname}" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      37    install -Dm644 "${srcdir}/usr/share/applications/${_appname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      38    for _icons in 16x16 32x32 48x48 64x64 128x128 256x256;do
    
      39        install -Dm644 "${srcdir}/usr/share/icons/hicolor/${_icons}/apps/${_appname}.png" \
    
      40            "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-bin}.png"
    
      41    done
    
      42    touch "${pkgdir}/opt/${pkgname%-bin}/debug.txt"
    
      43    install -Dm644 "${srcdir}/LICENSE-${pkgver}.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.html"
    
      44}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2