wechat-devtools

maintainer theahermann · 22 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and executes several categories of untrusted binaries: (1) A prebuilt NW.js SDK and Node.js runtime from npm.taobao.org (a Taobao/Alibaba mirror, not the official nodejs.org or nwjs.io distribution), (2) a WeChat DevTools Windows installer from servicewechat.com (official Tencent host, lower risk), (3) a 'compiler' tarball from a personal GitHub release (msojocs/wechat-web-devtools-linux), and (4) during build(), it runs 'npm install nw-gyp node-gyp -g' which fetches additional packages from npm at build time without pinned versions or checksums. The shell scripts (fix-cli.sh, fix-core.sh, rebuild-node-modules.sh, etc.) are executed during build and could run arbitrary code. The npm.taobao.org mirror is a third-party Chinese CDN mirror — while widely used in China, it is not the canonical upstream and has historically had availability/integrity concerns. The unpinned 'npm install' at build time (line 92) is a genuine supply-chain concern as it fetches live packages. All checksums for the local scripts are present and verified. The compiler tarball from a personal GitHub release is also a concern. Overall this is a legitimate supply-chain risk (executed binaries/code from non-canonical hosts plus live npm fetches) consistent with MEDIUM severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 source=("nwjs-v${_nwjs_ver}.tar.gz::https://npm.taobao.org/mirrors/nwjs/v${_nwjs_ver}/nwjs-sdk-v${_nwjs_ver}-linux-x64.tar.gz"

MEDIUM AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it MEDIUM (confidence 72%): This PKGBUILD downloads and executes several categories of untrusted binaries: (1) A prebuilt NW.js SDK and Node.js runtime from npm.taobao.org (a Taobao/Alibaba mirror, not the official nodejs.org or nwjs.io distribution), (2) a WeChat DevTools Windows installer from servicewechat.com (official Tencent host, lower risk), (3) a 'compiler' tarball from a personal GitHub release (msojocs/wechat-web-devtools-linux), and (4) during build(), it runs 'npm install nw-gyp node-gyp -g' which fetches additional packages from npm at build time without pinned versions or checksums. The shell scripts (fix-cli.sh, fix-core.sh, rebuild-node-modules.sh, etc.) are executed during build and could run arbitrary code. The npm.taobao.org mirror is a third-party Chinese CDN mirror — while widely used in China, it is not the canonical upstream and has historically had availability/integrity concerns. The unpinned 'npm install' at build time (line 92) is a genuine supply-chain concern as it fetches live packages. All checksums for the local scripts are present and verified. The compiler tarball from a personal GitHub release is also a concern. Overall this is a legitimate supply-chain risk (executed binaries/code from non-canonical hosts plus live npm fetches) consistent with MEDIUM severity.

1 higher static finding superseded - not the current verdict (shown for transparency)

HIGH npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time.

PKGBUILD:92 npm install nw-gyp node-gyp -g

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: msojocs <jiyecafe@gmail.com>
    
      2# Contributor: ccat3z <c0ldcat3z@gmail.com>
    
      3# Contributor: bruceutut <zttt183525594@gmail.com>
    
      4
    
      5# 方法参考
    
      6# https://github.com/msojocs/wechat-web-devtools-linux
    
      7# https://github.com/dragonation/wechat-devtools
    
      8# https://github.com/cytle/wechat_web_devtools
    
      9
    
      10_wechat_devtools_ver="1.06.2308310"
    
      11# https://servicewechat.com/wxa-dev-logic/download_redirect?type=x64&from=mpwiki&download_version=1052203030&version_type=1
    
      12_wechat_devtools_url="https://servicewechat.com/wxa-dev-logic/download_redirect?type=x64&from=mpwiki&download_version=${_wechat_devtools_ver//\./}&version_type=1"
    
      13# _wechat_devtools_url="https://dldir1.qq.com/WechatWebDev/release/p-ae42ee2cde4d42ee80ac60b35f183a99/wechat_devtools_1.05.2201240_x64.exe"
    
      14_wechat_devtools_md5="2e73b7fc2eb617b4a745c35e4fd63133"
    
      15
    
      16_wechat_devtools_exe="wechat_devtools_${_wechat_devtools_ver}_x64.exe"
    
      17_nwjs_ver="0.55.0"
    
      18_install_dir="/opt/wechat-devtools"
    
      19_node_version="16.4.2"
    
      20
    
      21pkgname=wechat-devtools
    
      22pkgver="${_wechat_devtools_ver}"  # 主版本号
    
      23pkgrel=1   # 修订版本号release
    
      24epoch=2    # 大版本迭代强制更新（维护者变更，尽量不用）
    
      25pkgdesc="WeChat Devtools For Linux. "
    
      26arch=("x86_64")
    
      27url="https://developers.weixin.qq.com/miniprogram/dev/devtools/download.html"
    
      28license=('unknown')
    
      29depends=('gconf' 'libxkbfile')
    
      30makedepends=('p7zip' 'python2' 'openssl' 'gcc' 'make' 'libssh2' 'krb5')
    
      31# compiler 用于可视化,以及编译
    
      32source=("nwjs-v${_nwjs_ver}.tar.gz::https://npm.taobao.org/mirrors/nwjs/v${_nwjs_ver}/nwjs-sdk-v${_nwjs_ver}-linux-x64.tar.gz"
    
      33        "${_wechat_devtools_exe}::${_wechat_devtools_url}"
    
      34        "node-v${_node_version}.tar.gz::https://npm.taobao.org/mirrors/node/v${_node_version}/node-v${_node_version}-linux-x64.tar.gz"
    
      35        "compiler-v${_wechat_devtools_ver}-${pkgrel}.tar.gz::https://github.com/msojocs/wechat-web-devtools-linux/releases/download/v${_wechat_devtools_ver}-${pkgrel}/compiler.tar.gz"
    
      36        "wechat-devtools.desktop"
    
      37        "logo.svg"
    
      38        "wechat-devtools"
    
      39        "wechat-devtools-cli"
    
      40        "fix-cli.sh"
    
      41        "fix-menu.sh"
    
      42        "fix-core.sh"
    
      43        "rebuild-node-modules.sh"
    
      44        "fix-package-name.js"
    
      45        "wxvpkg_pack.js"
    
      46        "wxvpkg_unpack.js"
    
      47        "fix-other.sh")
    
      48md5sums=('ac7680788544c457daee11aaf69798fe'
    
      49         '2e73b7fc2eb617b4a745c35e4fd63133'
    
      50         '4d14589085ebbf79ce504dc27330d33b'
    
      51         'ffa370a96aca134ea7a2c2d5d658b561'
    
      52         '4d3f5273be80a74741c841fcfa4185d3'
    
      53         '0f4353664123320280ea4d6bb295dce2'
    
      54         'ae685283b21becd9c097aca4571f7556'
    
      55         '912b5948dc8a968e1b53390173c9d363'
    
      56         '951538b31000bf541446502069dcd92f'
    
      57         'b4cab718cc7a9181c776eab8bf932df4'
    
      58         'ae62f9e78e4a3d0addb3c55c34333b87'
    
      59         'd39251e3b81e7e48506d0a8211a2c5d3'
    
      60         'd43f68ce696b5dad3ea4e7ff89b9d4ad'
    
      61         '38f8ed65b632c50ee5cef1231984f224'
    
      62         '005ce9329dfbd97106daab0f2ca4a90e'
    
      63         '5b24e5f379987f008bacda92d77fb2c8')
    
      64options=('!strip')
    
      65
    
      66prepare() {
    
      67    7z x -owechat_devtools ${_wechat_devtools_exe} code/package.nw
    
      68    mv wechat_devtools/code/package.nw package.nw
    
      69    rm -rf wechat_devtools
    
      70    ls | grep node-*linux* | xargs -I{} mv {} node
    
      71    ls | grep nwjs-*linux* | xargs -I{} mv {} nwjs
    
      72
    
      73    mkdir -p tools
    
      74    for file in *.js *.sh; do
    
      75        mv $file tools;
    
      76    done
    
      77}
    
      78
    
      79_log() {
    
      80    echo -e "\e[1;34m$@\e[0m"
    
      81}
    
      82
    
      83build() {
    
      84    # prepare node
    
      85    _log "prepare node v${_node_version}"
    
      86    export PATH="$srcdir/node/bin:$PATH"
    
      87
    
      88    # prepare nw-gyp
    
      89    _log "prepare nw-gyp"
    
      90    node --version
    
      91    npm uninstall node-gyp -g
    
      92    npm install nw-gyp node-gyp -g
    
      93
    
      94    # node bin
    
      95    _log "copy node exectuable"
    
      96    cp "$(which node)" "${srcdir}/node.${_node_version}"
    
      97
    
      98    # run fix scripts
    
      99    export NW_PACKAGE_DIR="${srcdir}/package.nw"
    
      100    export NW_VERSION=$_nwjs_ver
    
      101    # fix-package-name.js使用
    
      102    export srcdir=$srcdir
    
      103    export WINE=false
    
      104
    
      105    for script in fix-package-name.js fix-cli.sh fix-other.sh fix-menu.sh fix-core.sh rebuild-node-modules.sh; do
    
      106        _log "run ${script}"
    
      107        "${srcdir}/tools/${script}"
    
      108    done
    
      109
    
      110    # cleanup
    
      111    _log "done"
    
      112}
    
      113
    
      114package() {
    
      115    mkdir -p "${pkgdir}${_install_dir}"
    
      116    cd "${pkgdir}${_install_dir}"
    
      117
    
      118    cp -r "${srcdir}/nwjs" .
    
      119    cp -r "${srcdir}/package.nw" .
    
      120    find ./package.nw -type d | xargs -I {} chmod -R a+rx {}
    
      121
    
      122    cp ${srcdir}/node.${_node_version} nwjs/node
    
      123    cd nwjs && ln -s node node.exe && ln -s ../package.nw package.nw
    
      124
    
      125    install -Dm755 "${srcdir}/wechat-devtools" "${pkgdir}${_install_dir}/bin/wechat-devtools"
    
      126    install -Dm755 "${srcdir}/wechat-devtools-cli" "${pkgdir}${_install_dir}/bin/wechat-devtools-cli"
    
      127    install -Dm644 "${srcdir}/wechat-devtools.desktop" "${pkgdir}/usr/share/applications/wechat-devtools.desktop"
    
      128    install -Dm644 "${srcdir}/logo.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/wechat-devtools.svg"
    
      129    mkdir -p "${pkgdir}/usr/bin"
    
      130    ln -s "${_install_dir}/bin/wechat-devtools" "${pkgdir}/usr/bin/wechat-devtools"
    
      131    ln -s "${_install_dir}/bin/wechat-devtools-cli" "${pkgdir}/usr/bin/wechat-devtools-cli"
    
      132}
    
      133

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3