wind-bin

maintainer shilka · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary blob (a Debian .deb inside a ZIP) from d-cdn.wind.com.cn, which is Wind Information's own CDN domain (wind.com.cn is the official domain of 万得/Wind Information, a major Chinese financial data provider). The host is plausibly official, not a random personal server. However, the source URL contains no version string — the filename is 'com.wind.wft-kylinV10SP1_amd64.deb.zip' with no version embedded, meaning the upstream can silently replace the binary at any time without changing the URL. The md5sums provide only weak integrity guarantees (MD5 is broken for collision resistance). The package installs a large proprietary binary financial terminal that runs with user privileges. The combination of a mutable URL (no version in path), weak checksums, and a large executed binary blob from a CDN (even a plausibly official one) constitutes a real supply-chain concern: the binary could be updated silently and the checksum in the PKGBUILD would become stale/wrong without anyone noticing until a rebuild. This is a genuine medium-severity supply-chain risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://d-cdn.wind.com.cn/windnet/linux/${pkgprefix}_${pkgsuffix}.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary blob (a Debian .deb inside a ZIP) from d-cdn.wind.com.cn, which is Wind Information's own CDN domain (wind.com.cn is the official domain of 万得/Wind Information, a major Chinese financial data provider). The host is plausibly official, not a random personal server. However, the source URL contains no version string — the filename is 'com.wind.wft-kylinV10SP1_amd64.deb.zip' with no version embedded, meaning the upstream can silently replace the binary at any time without changing the URL. The md5sums provide only weak integrity guarantees (MD5 is broken for collision resistance). The package installs a large proprietary binary financial terminal that runs with user privileges. The combination of a mutable URL (no version in path), weak checksums, and a large executed binary blob from a CDN (even a plausibly official one) constitutes a real supply-chain concern: the binary could be updated silently and the checksum in the PKGBUILD would become stale/wrong without anyone noticing until a rebuild. This is a genuine medium-severity supply-chain risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: shilka <shilka [AT] gmail.com>
    
      2
    
      3pkgname=wind-bin
    
      4_pkgname=wind
    
      5pkgver=26.1.0.04151
    
      6pkgrel=1
    
      7pkgdesc="Wind financial terminal, 万得金融终端"
    
      8arch=("x86_64")
    
      9url="http://www.wind.com.cn"
    
      10license=("unknown")
    
      11depends=('libidn11' 'libxcrypt-compat')
    
      12provides=("$_pkgname")
    
      13install=wind-bin.install
    
      14pkgprefix="com.wind.wft-kylinV10SP1"
    
      15pkgsuffix="amd64.deb"
    
      16source=("https://d-cdn.wind.com.cn/windnet/linux/${pkgprefix}_${pkgsuffix}.zip"
    
      17         "${_pkgname}.sh")
    
      18md5sums=('0a9220750fd9b36ea8da3c3fa251dc23'
    
      19        'b91bddd9120a457da61f9f9077480ae2')
    
      20
    
      21prepare(){
    
      22    cd ${srcdir}
    
      23    ar p "com.wind.wft_${pkgver}_${pkgsuffix}" data.tar.xz | tar xJf -
    
      24
    
      25}
    
      26package(){
    
      27
    
      28    cd $srcdir
    
      29    mkdir -p $pkgdir/opt
    
      30    cp -rf usr $pkgdir/
    
      31    cp -rf opt/apps/com.wind.wft/files   ${pkgdir}/opt/wind
    
      32    cp -rf opt/apps/com.wind.wft/entries/* ${pkgdir}/usr/share
    
      33
    
      34    sed -i "s|^Exec=.*|Exec=wind|g;s|^Icon=.*|Icon=com.wind.wft|g" \
    
      35    $pkgdir/usr/share/applications/com.wind.wft.desktop
    
      36
    
      37    cd ..
    
      38    install -Dm755 ./${_pkgname}.sh ${pkgdir}/usr/bin/${_pkgname}
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2