toosheh-extractor

maintainer Master81 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt binary is downloaded from an S3 bucket (lisa-app) and installed directly into /usr/bin with no integrity verification (md5sums='SKIP'). The binary is executed code from an unofficial/personal S3 bucket rather than a verifiable upstream release page with signed artifacts. Even if the S3 bucket belongs to the vendor, there is no checksum to detect substitution or tampering, and S3 buckets can be misconfigured or taken over. The VPN warning in the description suggests this targets users in censored regions (likely Iran), which is a legitimate use case, but the lack of any integrity check on an executed binary from a non-standard host is a genuine supply-chain concern. This is a real medium-severity risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://s3-us-west-2.amazonaws.com/lisa-app/extract-linux-x64.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): A prebuilt binary is downloaded from an S3 bucket (lisa-app) and installed directly into /usr/bin with no integrity verification (md5sums='SKIP'). The binary is executed code from an unofficial/personal S3 bucket rather than a verifiable upstream release page with signed artifacts. Even if the S3 bucket belongs to the vendor, there is no checksum to detect substitution or tampering, and S3 buckets can be misconfigured or taken over. The VPN warning in the description suggests this targets users in censored regions (likely Iran), which is a legitimate use case, but the lack of any integrity check on an executed binary from a non-standard host is a genuine supply-chain concern. This is a real medium-severity risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Master81 <FreeFighter81 at protonmail dot com>
    
      2pkgname=toosheh-extractor
    
      3pkgver=4.3.7509.24771
    
      4pkgrel=2
    
      5pkgdesc="Official toosheh extractor CLI for Linux. Please USE A VPN or any anti-censorship tool before installing this package."
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://www.toosheh.org/download/"
    
      8license=('other')
    
      9depends=()
    
      10provides=(toosheh-extractor)
    
      11conflicts=(toosheh-extractor)
    
      12#getting from official link
    
      13source=("https://s3-us-west-2.amazonaws.com/lisa-app/extract-linux-x64.zip")
    
      14md5sums=('SKIP')
    
      15options=('!strip')
    
      16
    
      17
    
      18package() {
    
      19	install -d $pkgdir/usr/bin
    
      20	install -Dm755 "${srcdir}"/extract "${pkgdir}"/usr/bin/toosheh-extractor
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2