wechat-bin
MEDIUM
maintainer Kimiblock
28 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads prebuilt .deb files from a non-whitelisted host (dldir1v6.qq.com) which is plausibly official but not verified, and skips checksums, creating a supply-chain risk if the source were silently swapped.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:74
wechat-x86-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb files from a non-whitelisted host (dldir1v6.qq.com) which is plausibly official but not verified, and skips checksums, creating a supply-chain risk if the source were silently swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Kimiblock Moe
2
# Contributor: wszqkzqk
3
4
pkgname=wechat-bin
5
pkgver=4.1.13.23
6
pkgrel=1
7
epoch=
8
pkgdesc="微信是一种生活方式. This is a repackage of WeChat."
9
arch=('x86_64' 'aarch64' 'loong64')
10
url="https://weixin.qq.com/"
11
license=('LicenseRef-proprietary')
12
groups=()
13
options=(!debug !strip)
14
15
makedepends+=()
16
17
replaces+=()
18
19
depends=(
20
"nss"
21
"xcb-util-renderutil"
22
"xcb-util-keysyms"
23
"xcb-util-image"
24
"xcb-util-wm"
25
"libxkbcommon-x11"
26
"libxkbcommon"
27
"libxcb"
28
"gcc-libs"
29
"nspr"
30
"glibc"
31
"zlib"
32
"libxcomposite"
33
"glib2"
34
"libxrender"
35
"libxext"
36
"alsa-lib"
37
"dbus"
38
"libxrandr"
39
"fontconfig"
40
"pango"
41
"freetype2"
42
"libxfixes"
43
"cairo"
44
"libx11"
45
"expat"
46
"libvlc"
47
"libxdamage"
48
"libdrm"
49
"mesa"
50
"libglvnd"
51
"libpulse"
52
"hicolor-icon-theme"
53
)
54
55
optdepends=(
56
"wechat: Sandbox support and enhancements"
57
'ttf-twemoji: An emoji font that will work with WeChat'
58
'libjack.so: libjack_plugin.so'
59
'at-spi2-core: Accessibility in the browser part'
60
'xdg-desktop-portal-impl: XDG Desktop Portal implementation for File Chooser and ScreenCast'
61
)
62
63
makedepends+=(
64
"libarchive"
65
)
66
67
checkdepends=()
68
69
source=()
70
71
# The official site does not have versioned download, so checksums are skipped
72
73
source_x86_64=(
74
wechat-x86-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb"
75
)
76
77
source_aarch64=(
78
wechat-arm-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb"
79
)
80
81
source_loong64=(
82
wechat-loong64-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_LoongArch.deb"
83
)
84
85
86
md5sums_x86_64=('SKIP')
87
md5sums_aarch64=('SKIP')
88
md5sums_loong64=('SKIP')
89
90
function pkgver() {
91
tar -xf control.tar.xz ./control
92
cat control | grep 'Version: ' | cut -c '10-'
93
}
94
95
function package() {
96
tar -xf data.tar.xz ./opt
97
cp -r opt \
98
"${pkgdir}/"
99
tar -xf data.tar.xz ./usr
100
cp -r usr \
101
"${pkgdir}/"
102
install -d "${pkgdir}/usr/share/licenses/${pkgname}"
103
echo "https://www.wechat.com/us/service_terms.html" \
104
>"${pkgdir}/usr/share/licenses/${pkgname}/ToS.txt"
105
sed -i 's|/usr/bin/wechat|/opt/wechat/wechat|g' \
106
"${pkgdir}/usr/share/applications"/*.desktop
107
ln -sf "/opt/wechat/wechat" \
108
"${pkgdir}/usr/bin/wechat"
109
}
110
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 05:15:42 | Medium | 2 |