tradermaster

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from cdn.jin10.com (jin10 is a Chinese financial news/data platform, and jiaoyixia.com appears to be a related trading software site). The binary is a closed-source trading application with no source code available for inspection. The supply-chain concern is real: the .deb is fetched from a CDN subdomain of a third-party commercial site rather than a well-known forge or the software vendor's own official release infrastructure, and the sha512sum is a fixed checksum that only protects against accidental corruption, not against the CDN host being compromised or the file being silently replaced at the same URL. The package also installs multiple bundled shared libraries (libfmod, libstdc++, libGLEW, various Heimdal/crypto libs) that are executed at runtime, compounding the attack surface. This is a legitimate medium-severity supply-chain concern: a closed-source binary from a non-standard CDN host with bundled native libraries, not clearly malicious but not verifiably safe either.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("${pkgname}.deb::https://cdn.jin10.com/linuxclient/TraderMaster_20_04.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary .deb from cdn.jin10.com (jin10 is a Chinese financial news/data platform, and jiaoyixia.com appears to be a related trading software site). The binary is a closed-source trading application with no source code available for inspection. The supply-chain concern is real: the .deb is fetched from a CDN subdomain of a third-party commercial site rather than a well-known forge or the software vendor's own official release infrastructure, and the sha512sum is a fixed checksum that only protects against accidental corruption, not against the CDN host being compromised or the file being silently replaced at the same URL. The package also installs multiple bundled shared libraries (libfmod, libstdc++, libGLEW, various Heimdal/crypto libs) that are executed at runtime, compounding the attack surface. This is a legitimate medium-severity supply-chain concern: a closed-source binary from a non-standard CDN host with bundled native libraries, not clearly malicious but not verifiably safe either.

PKGBUILD

1 offending line(s) highlighted

      1#Maintainer: Skykey <zcxzxlc@163.com>
    
      2
    
      3pkgname=('tradermaster')
    
      4pkgver=3.0.0
    
      5pkgrel=1
    
      6pkgdesc="超强行情分析软件"
    
      7provides=("tradermaster")
    
      8url='http://jiaoyixia.com'
    
      9license=('unknown')
    
      10arch=('x86_64')
    
      11depends=('brotli' 'libbsd' 'libssh' 'sqlite' 'rtmpdump' 'gnutls' 'glfw-x11' 'glew' 'fontconfig' 'freetype2' 'libzip')
    
      12source=("${pkgname}.deb::https://cdn.jin10.com/linuxclient/TraderMaster_20_04.deb"
    
      13)
    
      14sha512sums=('9846035301fd6fe7298ee26686c74fefe5ebe6fc15b967ab26ee3cd98c0645f4ea3443411eb324f2a0df302e758548a150fb06755e634a631fb5fdf363827d39'
    
      15)
    
      16
    
      17package(){
    
      18	 cd ${srcdir}
    
      19	 tar -xJvf data.tar.xz -C "${pkgdir}"
    
      20
    
      21	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/TraderMaster "${pkgdir}"/opt/TraderMaster/TraderMaster
    
      22	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/run.sh "${pkgdir}"/opt/TraderMaster/run.sh
    
      23	 
    
      24        	 sed -i 's|/usr/bin/TraderMaster|/usr/lib/TraderMaster|g' "${pkgdir}"/opt/TraderMaster/run.sh
    
      25                         sed -i 's|/usr/lib/TraderMaster/TraderMaster|/opt/TraderMaster/TraderMaster|g' "${pkgdir}"/opt/TraderMaster/run.sh
    
      26	 sed -i 's|/usr/bin/TraderMaster|/opt/TraderMaster|g' "${pkgdir}"/usr/share/applications/TraderMaster.desktop
    
      27
    
      28	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libGLEW.so.2.1 "${pkgdir}"/usr/lib/TraderMaster/libGLEW.so.2.1
    
      29	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libfmod.so.6 "${pkgdir}"/usr/lib/TraderMaster/libfmod.so.6
    
      30	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libasn1.so.8 "${pkgdir}"/usr/lib/TraderMaster/libasn1.so.8
    
      31	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libgssapi.so.3 "${pkgdir}"/usr/lib/TraderMaster/libgssapi.so.3
    
      32	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libhcrypto.so.4 "${pkgdir}"/usr/lib/TraderMaster/libhcrypto.so.4
    
      33	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libheimbase.so.1 "${pkgdir}"/usr/lib/TraderMaster/libheimbase.so.1
    
      34	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libheimntlm.so.0 "${pkgdir}"/usr/lib/TraderMaster/libheimntlm.so.0
    
      35	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libhogweed.so.5 "${pkgdir}"/usr/lib/TraderMaster/libhogweed.so.5
    
      36	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libhx509.so.5 "${pkgdir}"/usr/lib/TraderMaster/libhx509.so.5
    
      37	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libnettle.so.7 "${pkgdir}"/usr/lib/TraderMaster/libnettle.so.7
    
      38	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libroken.so.18 "${pkgdir}"/usr/lib/TraderMaster/libroken.so.18
    
      39	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libsasl2.so.2 "${pkgdir}"/usr/lib/TraderMaster/libsasl2.so.2
    
      40	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libstdc++.so.6 "${pkgdir}"/usr/lib/TraderMaster/libstdc++.so.6
    
      41	 install -Dm755 "${pkgdir}"/usr/bin/TraderMaster/libwind.so.0 "${pkgdir}"/usr/lib/TraderMaster/libwind.so.0
    
      42	 
    
      43	 install -Dm644 "${pkgdir}"/usr/bin/TraderMaster/Resources/res.ext "${pkgdir}"/opt/TraderMaster/Resources/res.ext
    
      44	 
    
      45	 rm -rf "${pkgdir}"/usr/bin
    
      46	 
    
      47	 chmod 0755 "${pkgdir}"/usr
    
      48	 chmod -R 0755 "${pkgdir}"/usr/share
    
      49	 chown -R root:root "${pkgdir}"/usr
    
      50	 
    
      51	 
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2