workbuddy-bin

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

• PKGBUILD:37 npm install @vscode/ripgrep @vscode/sqlite3 @vscode/spdlog --omit=dev

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:22 source=("https://download.codebuddy.cn/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${pkgver}-${_commit}.dmg"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): Two genuine supply-chain concerns exist here: (1) The primary source is a macOS DMG pulled from download.codebuddy.cn (a Chinese CDN/vendor host, not a well-known official mirror) with SKIP'd checksums, meaning there is no integrity verification of the binary blob that gets unpacked and installed as the application. (2) During build(), npm install fetches @vscode/ripgrep, @vscode/sqlite3, and @vscode/spdlog from the npm registry without any pinned versions or lockfile, so the exact packages installed are determined at build time by whatever npm resolves. These are legitimate @vscode-scoped packages, but the lack of version pinning is a real (if low-probability) supply-chain risk. The SKIP checksums on the DMG are the more serious issue: any MITM or compromise of download.codebuddy.cn would silently deliver a different binary. Additionally, extracting a macOS DMG to install on Linux is non-standard and the resulting binary blob is not reproducible. The package is not clearly malicious, but the combination of an unverified binary from a non-standard host plus unpinned npm dependencies at build time constitutes a real medium-severity supply-chain concern.