uuyc

maintainer Particle_G · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Downloads a Windows installer EXE from NetEase's own CDN (a56.gdl.netease.com) with a pinned SHA256 checksum; the installer is bundled as data for the user to run later via Wine, not executed at build time. The EULA HTML is also fetched from the official domain. No obfuscation, no remote code execution at build/install time.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a Windows installer EXE from NetEase's own CDN (a56.gdl.netease.com) with a pinned SHA256 checksum; the installer is bundled as data for the user to run later via Wine, not executed at build time. The EULA HTML is also fetched from the official domain. No obfuscation, no remote code execution at build/install time.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "uuyc-${pkgver}.exe::https://a56.gdl.netease.com/UURemote_Setup_${pkgver}_0715193023_gwqd.exe"
PKGBUILD:18 'UU-Remote-EULA.html::https://uuyc.163.com/contact/20240402/40294_1146065.html'

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: ParticleG <particle_g@outlook.com>
    
      2
    
      3pkgname=uuyc
    
      4pkgver=4.33.0.8907
    
      5pkgrel=3
    
      6pkgdesc='NetEase UU Remote (网易UU远程) client configured for Wine'
    
      7arch=('x86_64')
    
      8url='https://uuyc.163.com/'
    
      9license=('LicenseRef-UU-Remote-EULA')
    
      10depends=('wine>=11.1' 'hicolor-icon-theme' 'procps-ng' 'util-linux')
    
      11makedepends=('7zip')
    
      12optdepends=('libnotify: desktop notifications during first-run setup')
    
      13options=('!strip' '!debug')
    
      14source=(
    
      15  "uuyc-${pkgver}.exe::https://a56.gdl.netease.com/UURemote_Setup_${pkgver}_0715193023_gwqd.exe"
    
      16  'uuyc'
    
      17  'uuyc.desktop'
    
      18  'UU-Remote-EULA.html::https://uuyc.163.com/contact/20240402/40294_1146065.html'
    
      19)
    
      20noextract=("uuyc-${pkgver}.exe")
    
      21sha256sums=(
    
      22  '5e3cfe8cfdc6552c1fc26f1ad2c94df133ca20dc3c45c23155358c32ac9bf53e'
    
      23  '6bc2df340099809a8b5bd4e187252509ef94cb575f3865d805c98c4684aaa8d3'
    
      24  '03c7d6d57d291dc2d5cf6d7af46ce606b1d5f488f819363af0158c2783376397'
    
      25  '3a2b28509a7c54bb701ae877af8312f2c366388c198427f483cf791c6eae0b65'
    
      26)
    
      27
    
      28prepare() {
    
      29  rm -rf "$srcdir/uuyc-icon"
    
      30  7z x -y -o"$srcdir/uuyc-icon" \
    
      31    "$srcdir/uuyc-${pkgver}.exe" '.rsrc/ICON/6'
    
      32}
    
      33
    
      34package() {
    
      35  install -Dm755 "$srcdir/uuyc" "$pkgdir/usr/bin/uuyc"
    
      36  install -Dm644 "$srcdir/uuyc.desktop" \
    
      37    "$pkgdir/usr/share/applications/uuyc.desktop"
    
      38  install -Dm644 "$srcdir/uuyc-${pkgver}.exe" \
    
      39    "$pkgdir/usr/share/uuyc/uuyc-installer.exe"
    
      40  install -Dm644 "$srcdir/uuyc-icon/.rsrc/ICON/6" \
    
      41    "$pkgdir/usr/share/icons/hicolor/256x256/apps/uuyc.png"
    
      42  install -Dm644 "$srcdir/UU-Remote-EULA.html" \
    
      43    "$pkgdir/usr/share/licenses/$pkgname/UU-Remote-EULA.html"
    
      44
    
      45  printf '%s\n' "$pkgver" >"$pkgdir/usr/share/uuyc/upstream-version"
    
      46  printf '%s-%s\n' "$pkgver" "$pkgrel" \
    
      47    >"$pkgdir/usr/share/uuyc/package-release"
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 pkgname=uuyc
 pkgver=4.33.0.8907
 pkgrel=3
-pkgdesc='NetEase UU Remote client configured for Wine'
+pkgdesc='NetEase UU Remote (网易UU远程) client configured for Wine'
 arch=('x86_64')
 url='https://uuyc.163.com/'
 license=('LicenseRef-UU-Remote-EULA')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 01:17:11	LOW	3
2026-07-21 01:15:36	MEDIUM	2
2026-07-21 00:24:15	LOW	3
2026-07-20 23:17:00	LOW	3
2026-07-20 23:15:21	MEDIUM	3