vyprvpn-linux-cli

maintainer orphaned · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binary .deb packages from support.vyprvpn.com (a Zendesk-hosted article attachment URL for Golden Frog's VyprVPN), extracts them, and installs the binaries directly into the system. While support.vyprvpn.com is the official vendor support portal, the source is an article attachment URL (hc/article_attachments/...) which is not a versioned release endpoint — these URLs can be replaced or updated by the vendor without changing the URL, making the sha256sums the only integrity guarantee. The binaries are executed code (VPN client daemons and CLI tools) installed to /usr/bin and /usr/sbin with 755 permissions, including a systemd service. There is no source build, no reproducibility, and the license is listed as 'unknown'. This is a classic prebuilt-binary-from-vendor-support-page pattern: not clearly malicious, but a genuine supply-chain concern since the attachment host is not a formal release channel with cryptographic signing (e.g., GPG). The sha256sums do provide a checksum anchor, which mitigates but does not eliminate the risk. Medium severity is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source_i686=("https://support.vyprvpn.com/hc/article_attachments/360054448951/vyprvpn-linux-cli-1.8.i386.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads prebuilt binary .deb packages from support.vyprvpn.com (a Zendesk-hosted article attachment URL for Golden Frog's VyprVPN), extracts them, and installs the binaries directly into the system. While support.vyprvpn.com is the official vendor support portal, the source is an article attachment URL (hc/article_attachments/...) which is not a versioned release endpoint — these URLs can be replaced or updated by the vendor without changing the URL, making the sha256sums the only integrity guarantee. The binaries are executed code (VPN client daemons and CLI tools) installed to /usr/bin and /usr/sbin with 755 permissions, including a systemd service. There is no source build, no reproducibility, and the license is listed as 'unknown'. This is a classic prebuilt-binary-from-vendor-support-page pattern: not clearly malicious, but a genuine supply-chain concern since the attachment host is not a formal release channel with cryptographic signing (e.g., GPG). The sha256sums do provide a checksum anchor, which mitigates but does not eliminate the risk. Medium severity is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Generated by debtap
    
      2# Maintainer: Peter B <aur at boromisp dot com>
    
      3# Contributor: Caio Prado <cagprado at qq dot com>
    
      4#
    
      5# Initial setup thanks to debtap (https://github.com/helixarch/debtap)
    
      6pkgname=vyprvpn-linux-cli
    
      7pkgver=1.8
    
      8pkgrel=1
    
      9pkgdesc="A simple service and command line interface to manage NetworkManager based connections to VyprVPN."
    
      10arch=('i686' 'x86_64')
    
      11url="http://www.goldenfrog.com"
    
      12license=('unknown')
    
      13depends=('networkmanager' 'networkmanager-openvpn' 'networkmanager-pptp' 'networkmanager-vpnc')
    
      14options=('!strip' '!emptydirs')
    
      15
    
      16backup=('etc/vyprvpn/vyprvpn_service.conf')
    
      17install=$pkgname.install
    
      18
    
      19source=("$pkgname.install")
    
      20source_i686=("https://support.vyprvpn.com/hc/article_attachments/360054448951/vyprvpn-linux-cli-1.8.i386.deb")
    
      21source_x86_64=("https://support.vyprvpn.com/hc/article_attachments/360054448971/vyprvpn-linux-cli-1.8.amd64.deb")
    
      22
    
      23sha256sums=('310cfdcf3d8b84789923139f3ce918003ad743bddf8bed72bc23bef90a43240b')
    
      24sha256sums_i686=('a5b6a19faa3cb49b8850c79e5f99daf3e995250c286dd575e2aa37b06b9e8ae5')
    
      25sha256sums_x86_64=('c2c67794b6f4bcdf5f2e3d1e8eeab6a2bff9f452ccc70032b9a408c9f98d5511')
    
      26
    
      27prepare(){
    
      28	# Extract data
    
      29	tar xf data.tar.xz
    
      30}
    
      31
    
      32package(){
    
      33	install -d "$pkgdir"/usr
    
      34	cp -R "$srcdir"/usr/bin "$pkgdir"/usr
    
      35	cp -R "$srcdir"/usr/share "$pkgdir"/usr
    
      36	cp "$srcdir"/usr/sbin/* "$pkgdir"/usr/bin
    
      37	chmod 755 "$pkgdir"/usr/bin/*
    
      38
    
      39	install -d "$pkgdir"/etc
    
      40	install -d "$pkgdir"/usr/lib
    
      41	cp -R "$srcdir"/etc/vyprvpn "$pkgdir"/etc
    
      42	cp -R "$srcdir"/etc/systemd "$pkgdir"/usr/lib
    
      43	chmod 644 "$pkgdir"/usr/lib/systemd/system/vyprvpn.service
    
      44
    
      45	touch "$pkgdir"/etc/vyprvpn/vyprvpn_service.conf
    
      46	chmod 600 "$pkgdir"/etc/vyprvpn/vyprvpn_service.conf
    
      47
    
      48	sed -i '/ExecStop/c\KillMode=process' "$pkgdir"/usr/lib/systemd/system/vyprvpn.service
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2