typora-with-plugin

maintainer fc-ibb105 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD downloads Typora from download2.typoraio.cn, which is the official Chinese CDN for Typora (typoraio.cn is the official Chinese site for Typora). The plugin tarball is fetched via a GitHub proxy (github.moeyy.xyz), which is a common workaround for GitHub access issues in China — it proxies the official obgnail/typora_plugin release tarball. Both sources have sha512sums provided (though typora_plugin_sum is empty/blank, which is a concern but more of a 'broken' packaging issue than a security one). The commented-out activation bypass code is notable but is commented out and not executed, so it does not constitute active piracy. The overall pattern is a legitimate Chinese-market package using regional mirrors. The empty typora_plugin_sum means the plugin tarball has no integrity check, which is sloppy but the risk is low given it's a JS plugin injected into the Electron app's HTML — not a native binary. This is low severity: non-standard hosts but consistent with official vendor infrastructure for the Chinese market, and the missing checksum is a quality issue rather than an active attack.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD downloads Typora from download2.typoraio.cn, which is the official Chinese CDN for Typora (typoraio.cn is the official Chinese site for Typora). The plugin tarball is fetched via a GitHub proxy (github.moeyy.xyz), which is a common workaround for GitHub access issues in China — it proxies the official obgnail/typora_plugin release tarball. Both sources have sha512sums provided (though typora_plugin_sum is empty/blank, which is a concern but more of a 'broken' packaging issue than a security one). The commented-out activation bypass code is notable but is commented out and not executed, so it does not constitute active piracy. The overall pattern is a legitimate Chinese-market package using regional mirrors. The empty typora_plugin_sum means the plugin tarball has no integrity check, which is sloppy but the risk is low given it's a JS plugin injected into the Electron app's HTML — not a native binary. This is low severity: non-standard hosts but consistent with official vendor infrastructure for the Chinese market, and the missing checksum is a quality issue rather than an active attack.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 "https://download2.typoraio.cn/linux/$_filename"

PKGBUILD

1 offending line(s) highlighted

      1pkgname=typora-with-plugin
    
      2_pkgname=typora
    
      3_pluginame=typora_plugin
    
      4typora_ver=1.10.8
    
      5typora_plugin_ver=1.13.3
    
      6pkgver=${typora_ver}_plugin_${typora_plugin_ver}
    
      7pkgrel=1
    
      8pkgdesc="一款 Markdown 编辑器和阅读器（with typora_plugin）"
    
      9arch=('x86_64')
    
      10license=('custom:"Copyright (c) 2015 Abner Lee All Rights Reserved."')
    
      11url="https://typoraio.cn/"
    
      12github_proxy_url="https://github.moeyy.xyz"
    
      13depends=('gtk3' 'nss' 'alsa-lib')
    
      14provides=("$_pkgname")
    
      15conflicts=("$_pkgname")
    
      16optdepends=(
    
      17	'noto-fonts-emoji: Or some other emoji font to see emojis'
    
      18	'pandoc: Import/export for extra file formats')
    
      19backups=(
    
      20    'usr/share/typora/resources/plugin/global/settings/custom_plugin.user.toml'
    
      21    'usr/share/typora/resources/plugin/global/settings/hotkey.user.toml'
    
      22    'usr/share/typora/resources/plugin/global/settings/settings.user.toml'
    
      23    )
    
      24_filename="${_pkgname}_${typora_ver}_amd64.deb"
    
      25_pluginfilename="${_pluginame}-${typora_plugin_ver}"
    
      26source=(
    
      27    "https://download2.typoraio.cn/linux/$_filename"
    
      28    "$_pkgname.sh"
    
      29    "${github_proxy_url}/https://github.com/obgnail/typora_plugin/archive/refs/tags/${typora_plugin_ver}.tar.gz")
    
      30
    
      31typora_sum=dc08b3077388a9168854da0306b32d3153bda6df25c6aa21c061adc6cc8447a42e4368ddcc5ec24cb8b5906cb5342d096ff8efa550e8cd2eeed3683c3fcfb466
    
      32typora_plugin_sum=
    
      33sha512sums=(
    
      34    $typora_sum
    
      35    'de9c883c63f3ea35bd551c8761e605f8e1a3468943e000abcbf94bb0c5cbb5f0f6c7fa4d49ab39c177f167e0e3d0b061c861bf828627b4a34f7f1589119c3d04'
    
      36    $typora_plugin_sum
    
      37)
    
      38
    
      39_patch_plugin() {
    
      40  tar xvf ${typora_plugin_ver}.tar.gz -C "$pkgdir/"
    
      41  mv $pkgdir/$_pluginfilename/plugin $pkgdir/usr/share/typora/resources/
    
      42  rm -rf $pkgdir/${_pluginfilename}
    
      43  sed -i 's@\(frame.js" defer="defer"></script>\)@\1<script src="./plugin/index.js" defer="defer"></script>@g' $pkgdir/usr/share/typora/resources/window.html
    
      44}
    
      45
    
      46package() {
    
      47	export LC_ALL=en_US.UTF-8
    
      48	# unpack archive
    
      49	bsdtar -xf data.tar.zst -C "$pkgdir/"
    
      50	_patch_plugin
    
      51	# remove lintian overrides
    
      52	rm -rf "$pkgdir/usr/share/lintian/"
    
      53	# replace bin link with custom launch script
    
      54	rm -rf "$pkgdir/usr/bin/$_pkgname"
    
      55	install -m755 "$srcdir/$_pkgname.sh" "$pkgdir/usr/bin/$_pkgname"
    
      56	# move license to correct path
    
      57	install -Dm644 "$pkgdir/usr/share/doc/$_pkgname/copyright" "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      58	# delete previous copyright path
    
      59	rm "$pkgdir/usr/share/doc/$_pkgname/copyright"
    
      60	# delete doc dir if empty
    
      61	rmdir --ignore-fail-on-non-empty "$pkgdir/usr/share/doc/$_pkgname" "$pkgdir/usr/share/doc"
    
      62	# remove change log from application comment
    
      63	sed -i '/Change Log/d' "$pkgdir/usr/share/applications/typora.desktop"
    
      64	# fix permissions
    
      65	find "$pkgdir" -type d -exec chmod 755 {} \;
    
      66#	# activation
    
      67#	resources_dir=$pkgdir/usr/share/typora/resources
    
      68#	pd_dir=$resources_dir/page-dist
    
      69#	js_file=$pd_dir/static/js/LicenseIndex.180dd4c7.4da8909c.chunk.js
    
      70#	sed -i 's/e.hasActivated="true"==e.hasActivated/e.hasActivated="true"=="true"/g' "$js_file"
    
      71#	# remove activation window
    
      72#	license_html=$pd_dir/license.html
    
      73#	sed -i 's%</body></html>%</body><script>window.onload=function(){setTimeout(()=>{window.close();},5);}</script></html>%g' "$license_html"
    
      74#	# change unredistered notification
    
      75#	pannel_file=$resources_dir/locales/zh-Hans.lproj/Panel.json
    
      76#	sed -i 's/"UNREGISTERED":"未激活"/"UNREGISTERED":"已激活"/g' "$pannel_file"
    
      77#	#get permissions of user setting files
    
      78#	chmod 777 $resources_dir/plugin/global/settings/*.user.toml 
    
      79}
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2